HTTP headers
Cross-Origin-Resource-Policy HTTP Header Meaning
Cross-Origin-Resource-Policy controls which origins can embed a resource.
Meaning
The resource is telling browsers whether other origins may include it as a subresource.
Where it appears
Sites send it on images, scripts, documents, or downloads that should not be loaded cross-origin.
What to check
Check whether same-origin, same-site, or cross-origin matches the resource's real embed requirements.
Example
Cross-Origin-Resource-Policy: same-originCommon values and directives
same-origin- Only the same origin may load the resource.
same-site- Same-site origins may load the resource.
cross-origin- Cross-origin loads are allowed.