CORP controls which origins can load a resource. When set to same-origin, only pages from the same origin can embed the resource. This prevents hotlinking, unauthorized data access, and Spectre-type attacks against your resources.

What is the difference between CORP and CORS?

CORS (Cross-Origin Resource Sharing) allows cross-origin requests to your API. CORP blocks cross-origin embedding of your resources. They solve different problems: CORS is for APIs, CORP is for static resources and preventing Spectre attacks.

When should I use cross-origin instead of same-origin?

Use cross-origin for resources that are intentionally public — CDN-hosted scripts, public images, web fonts served to third parties. Use same-origin for everything private — API responses, user data, internal assets.

Cross-Origin-Resource-Policy (CORP) Header Explained

Cross-Origin-Resource-Policy (CORP) is an HTTP response header that prevents other websites from loading your resources (images, scripts, fonts) in their pages. Setting it to same-origin or same-site blocks unauthorized hotlinking and prevents your resources from being used in Spectre-type side-channel attacks.

Recommended Value

Cross-Origin-Resource-Policy: same-origin

What Each Directive Does

Directive	Purpose
`same-origin`	Only pages from the same origin can load this resource
`same-site`	Pages from the same site (same eTLD+1) can load this resource
`cross-origin`	Any origin can load this resource (equivalent to no protection)

What Happens Without This Header

Without CORP, any website can embed your images, scripts, and API responses. This enables hotlinking (bandwidth theft), data exfiltration if your resources contain sensitive data, and Spectre-type attacks that can read the content of cross-origin resources loaded into the attacker's process.

How to Implement

# Nginx — for API/private resources
add_header Cross-Origin-Resource-Policy "same-origin" always;

# Nginx — for public CDN assets
add_header Cross-Origin-Resource-Policy "cross-origin" always;

# Express.js
app.use('/api', (req, res, next) => {
  res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
  next();
});

Testing and Report-Only

CORP does not have a report-only mode. Apply same-origin to private resources and API endpoints. Use cross-origin for public assets that legitimately need to be embedded by third parties (CDN assets, public images).