Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Cross-Origin-Resource-Policy

See original GitHub issue

There’s a relatively new HTTP header called Cross-Origin-Resource-Policy which Helmet could utilize.

MDN docs:

Now I’m not sure how it affects or if it takes precedence (when applicable) over X-Frame-Options, CSP’s frame-ancestors and X-Permitted-Cross-Domain-Policies.

Browser support bugs can be found here: https://github.com/Fyrd/caniuse/issues/4355

Issue Analytics

State:
Created 5 years ago
Comments:14 (9 by maintainers)

Top GitHub Comments

1reaction

jraoultcommented, Apr 8, 2020

@EvanHahn I found this ystd, it might help (https://youtu.be/vfAHa5GBLio?t=1217)

1reaction

Malvozcommented, Jan 23, 2020

@rajeshsusai that link only talks about SameSite cookies, and not the Cross-Origin-Resource-Policy HTTP header. CORP has been available in Chrome since v73.

Top Results From Across the Web

Cross-Origin Resource Policy (CORP) - HTTP - MDN Web Docs

Cross-Origin-Resource-Policy is an opt-in response header which can protect any resource; there is no need for browsers to sniff MIME types.

HTTP headers | Cross-Origin-Resource-Policy - GeeksforGeeks

The Cross-Origin-Resource-Policy is an HTTP response-type header that allows the servers to protect against certain cross-origin or ...

Consider deploying cross-origin resource policy!

The Cross-Origin-Resource-Policy ( CORP ) header allows you to control the set of origins that are empowered to include a resource. It is...

Cross-Origin-Resource-Policy - HTTP

The HTTP Cross-Origin-Resource-Policy response header conveys a desire that the browser blocks no-cors cross-origin/cross-site requests to the given ...

Cross-Origin Resource Policy - Chrome Platform Status

“Cross-Origin-Resource-Policy” response header allows http servers to ask the browser to prevent cross-origin or cross-site embedding of the ...