Consider asserting a `Cross-Origin-Resource-Policy`?

Hey folks! Hopefully this is a reasonable repository for requests like this one. 😃

Cross-Origin-Resource-Policy (CORP) is an HTTP response header that asserts a scope in which a given resource is allowed to be embedded. Today, the default for all resources is to allow cross-site loads, which unfortunately creates the conditions for side-channel attacks via Spectre, et al. With this background, browser vendors are interested in changing this default generally in the long-term, and in the short-term will allow developers to require explicit opt-in via Cross-Origin-Embedder-Policy. This opt-in will be a prerequisite for some particularly interesting APIs like SharedArrayBuffer.

To support this migration, it would be ideal if y’all could begin adding this assertion explicitly to resources that are expected to be used by various sites out there on the internet (e.g. by sending a Cross-Origin-Resource-Policy: cross-origin header). This should be a no-op in the status quo, and will ensure that y’all aren’t blocking developers from opting-into Cross-Origin-Embedder-Policy (and therefore exciting new APIs).

If there’s any more context I can give you about this set of features, I’d be happy to chat!

[kweij]

@mikewest, good call on the Chrome bug. I’ve reported it and it’s fixed already: https://bugs.chromium.org/p/chromium/issues/detail?id=1287500

[MartinKolarik]

Thanks for the clarification. We’ll add this in the near future.