https://nalar.dev/tags/corp/ Recent content in CORP on Nalar Hugo en-us Tue, 22 Sep 2026 00:00:00 +0000 https://nalar.dev/cross-origin-resource-policy-controls-resource-embedding/ Tue, 22 Sep 2026 00:00:00 +0000 https://nalar.dev/cross-origin-resource-policy-controls-resource-embedding/ <h1 id="cross-origin-resource-policy-controls-resource-embedding">Cross-Origin-Resource-Policy Controls Resource Embedding</h1> <p>A server can publish an image, script, font, or other resource at a URL without intending every site on the web to embed it. Network reachability alone does not express that boundary. A browser may be able to request a resource even when the response is not exposed to JavaScript through the same-origin policy.</p> <p><code>Cross-Origin-Resource-Policy</code> (CORP) gives the resource server a response-side control for that case. The header tells supporting browsers which relationship between the requesting context and the resource is acceptable for relevant no-CORS requests. If the relationship violates the policy, the browser blocks use of the response body.</p> https://nalar.dev/cross-origin-resource-policy-controls-no-cors-embedding/ Mon, 21 Sep 2026 00:00:00 +0000 https://nalar.dev/cross-origin-resource-policy-controls-no-cors-embedding/ <h1 id="cross-origin-resource-policy-controls-no-cors-embedding">Cross-Origin-Resource-Policy Controls no-cors Embedding</h1> <p>Web pages routinely embed resources without granting JavaScript direct access to their response bytes. Images, classic scripts, media, and other subresources can use <code>no-cors</code> request mode, where the browser permits forms of cross-origin loading while keeping the response opaque to script.</p> <p>That default is useful for the web, but a resource owner may need a tighter boundary. <code>Cross-Origin-Resource-Policy</code> (CORP) is an HTTP response header that tells the browser which origins or sites may consume a response through the policy&rsquo;s <code>no-cors</code> path.</p>