Cross-Origin-Resource-Policy (CORP)

Set on your assets to declare who is allowed to embed them, protecting resources from being pulled into other sites and read via side-channels.

What it is

Cross-Origin-Resource-Policy (CORP) is set on a resource (an image, script, JSON file, etc.) to tell the browser which origins may embed it. It is a defense against speculative side-channel attacks (Spectre) and cross-site leaks: a resource that says same-origin cannot be loaded by another site at all.

Values

same-origin: Only same-origin documents may load the resource.
same-site: Only documents from the same site (registrable domain) may load it.
cross-origin: Any origin may load it. Required for CDN assets and public APIs meant to be embedded anywhere.

HTTP RESPONSE HEADER

Cross-Origin-Resource-Policy: same-origin

Required under COEP

When an embedding page uses Cross-Origin-Embedder-Policy: require-corp, every cross-origin resource it loads must send Cross-Origin-Resource-Policy: cross-origin (or pass CORS), or it is blocked.

Why it matters

It stops sensitive resources (private images, user-specific JSON) from being embedded by attacker-controlled sites.
It is a key mitigation for Spectre-style cross-origin read attacks.
Public assets served from a CDN need cross-origin so they remain loadable by COEP-isolated pages.

Common mistakes

Setting same-origin on a public CDN asset, which then fails to load on any other site that legitimately embeds it.
Confusing CORP (who may embed my resource) with CORS (who may read my resource with credentials) — they solve different problems.
Forgetting to add cross-origin to third-party assets when adopting COEP, causing them to be blocked.

How WebInspect checks this

WebInspect reports the CORP value on responses and explains its embedding scope.
It flags public resources that would break under a consumer's COEP because they lack cross-origin.
It distinguishes CORP from CORS so the report does not conflate resource-embedding with cross-origin reads.