Can someone explain the difference between the Access-Control-Allow-Origin header and the Cross-Origin-Resource-Policy header?

According to MDN:
The Access-Control-Allow-Origin response header indicates whether the response can be shared with requesting code from the given origin.

Cross-Origin Resource Policy is a policy set by the Cross-Origin-Resource-Policy HTTP header that lets web sites and applications opt in to protection against certain requests from other origins (such as those issued with elements like and ), to mitigate speculative side-channel attacks, like Spectre, as well as Cross-Site Script Inclusion attacks.

CORP is an additional layer of protection beyond the default same-origin policy. Cross-Origin Resource Policy complements Cross-Origin Read Blocking (CORB), which is a mechanism to prevent some cross-origin reads by default.

As this policy is expressed via a response header, the actual request is not prevented—rather, the browser prevents the result from being leaked by stripping the response body.

What different things can be achieved with these two headers? I think the internet needs information about this, as security headers are still one of the major things done wrong and i could not find any information about the difference of these two headers.

2 Answers 2


CORS (Cross-Origin Resource Sharing) in general, and the Access-Control-Allow-... headers in particular, are a way to relax same-origin policy. They are used when you need to allow cross-origin requests that would usually fail to instead succeed, and in particular to allow cross-origin requesters to see the response body (which is normally not visible to the initiating page for cross-origin requests). Same-origin policy in general includes the cross-origin read blocking policy, which prevents some (but not all) access to cross-origin requests (scripts and images are two major counterexamples).

CORP is basically the opposite of CORS. CORP is a way of tightening the same-origin policy, removing the response from requests where the response would normally be processed. It is not widely used, and not generally considered essential, but it could in some cases protect a site's users from attacks that compromise the browser security model (as Spectre did/does) by not processing the response even in situations where same-origin policy would allow it (such as scripts or images).


When a website requests resources from a different origin, it is considered a cross-origin request. Browsers implement a same-origin policy to restrict such requests. The same-origin policy allows a website to access data from another page only if both pages have the same origin. We can alter this behavior through the Cross-Origin Resource Sharing (CORS).

However, the same-origin policy does not prevent the browser from embedding resources from other origins. For example, it can display images using the <img> tag, or play media using <video> even if those resources come from other origins. We can disallow other origins from embedding our resources by configuring the Cross-Origin-Resource-Policy (CORP).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .