Cross-Origin-Resource-Policy

The HTTP Cross-Origin-Resource-Policy response header conveys a desire that the browser blocks no-cors cross-origin/cross-site requests to the given resource.

Cross-Origin-Resource-Policy: same-site | same-origin | cross-origin

The response header below will cause compatible user agents to disallow cross-origin no-cors requests:

Cross-Origin-Resource-Policy: same-origin

For more examples, see https://resourcepolicy.fyi/.

• Cross-Origin Resource Policy (CORP) explainer
• Consider deploying Cross-Origin Resource Policy
• Access-Control-Allow-Origin