CORP

2 articles

Cybersecurity 22 Sep 2026 6 min read

Cross-Origin-Resource-Policy Controls Resource Embedding

Cross-Origin-Resource-Policy Controls Resource Embedding A server can publish an image, script, font, or other resource at a URL without intending every site on the web to embed it. Network reachability alone does not express that boundary. A browser may be able to request a resource even when the response is not exposed to JavaScript through the same-origin policy. Cross-Origin-Resource-Policy (CORP) gives the resource server a response-side control for that case. The header tells supporting browsers which relationship between the requesting context and the resource is acceptable for relevant no-CORS requests. If the relationship violates the policy, the browser blocks use of the response body.

Cybersecurity Web Security

Cybersecurity 21 Sep 2026 5 min read

Cross-Origin-Resource-Policy Controls no-cors Embedding

Cross-Origin-Resource-Policy Controls no-cors Embedding Web pages routinely embed resources without granting JavaScript direct access to their response bytes. Images, classic scripts, media, and other subresources can use no-cors request mode, where the browser permits forms of cross-origin loading while keeping the response opaque to script. That default is useful for the web, but a resource owner may need a tighter boundary. Cross-Origin-Resource-Policy (CORP) is an HTTP response header that tells the browser which origins or sites may consume a response through the policy’s no-cors path.

Cybersecurity Web Security