Cross-Origin-Resource-Policy

Note: Due to a bug in Chrome, setting Cross-Origin-Resource-Policy can break PDF rendering, preventing visitors from being able to read past the first page of some PDFs.

The HTTP Cross-Origin-Resource-Policy response header conveys a desire that the browser blocks no-cors cross-origin/cross-site requests to the given resource.

Header type	Response header
Forbidden header name	no

Syntax

Cross-Origin-Resource-Policy: same-site | same-origin | cross-origin

Examples

The response header below will cause compatible user agents to disallow cross-origin no-cors requests:

Cross-Origin-Resource-Policy: same-origin

For more examples, see https://resourcepolicy.fyi/.

Specifications

Specification
Fetch Standard (Fetch) # cross-origin-resource-policy-header

Browser compatibility

	Desktop						Mobile
	Chrome	Edge	Firefox	Internet Explorer	Opera	Safari	WebView Android	Chrome Android	Firefox for Android	Opera Android	Safari on IOS	Samsung Internet
`Cross-Origin-Resource-Policy`	73 ["Until version 75, downloads for files with this header would fail in Chrome. See bug 952834.", "From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See bug 1074261. From version 86, partial PDF loading is disabled."]	79	74 69	No	No	12	73 ["Until version 75, downloads for files with this header would fail in WebView. See bug 952834.", "From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See bug 1074261. From version 86, partial PDF loading is disabled."]	73 ["Until version 75, downloads for files with this header would fail in Chrome. See bug 952834.", "From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See bug 1074261. From version 86, partial PDF loading is disabled."]	No	No	12	11.0

Cross-Origin-Resource-Policy

Cross-Origin-Resource-Policy

Syntax

Examples

Specifications

Browser compatibility

See also