Cross-Origin-Resource-Policy

Scan.now reads the Cross-Origin-Resource-Policy header on the response to / and on the same-origin assets it fetches while parsing the page. The accepted values are same-origin, same-site and cross-origin. This check is informational: a public web page is meant to be loaded by anyone, so the absence of the header on the homepage is noted rather than penalised, and the report focuses on what it implies for the rest of the origin. When a Cross-Origin-Embedder-Policy: require-corp header is also present, Scan.now points out that every cross-origin subresource must now send CORP (or be loaded with CORS), because otherwise the browser will refuse to load it. The companion window-isolation header is covered in cross-origin-opener-policy.

By default any site can include your resources with <script>, <img>, <video> or a fetch() in no-cors mode. The including page cannot read the bytes directly, but the bytes are loaded into its renderer process, which is enough for Spectre-class side channels and for a family of cross-site leaks (XS-Leaks) that infer content from timing, size or error events. Browsers already block cross-origin loads of HTML, JSON and XML through Cross-Origin Read Blocking, but images, scripts, fonts and media are not covered. The realistic exposure is an authenticated JSON or image endpoint, such as an avatar keyed by user ID or an API response, that an attacker page embeds to learn whether a visitor is logged in or which account they hold. CORP lets the server declare which origins may embed each response, which is the right control for anything personalised.

Set same-origin on anything personalised or private and cross-origin on assets that other sites legitimately embed, such as a CDN-hosted font or widget. nginx, applied per location:

location /api/ {
    add_header Cross-Origin-Resource-Policy "same-origin" always;
}
location /static/ {
    add_header Cross-Origin-Resource-Policy "cross-origin" always;
}

Apache:

<Location "/api">
    Header always set Cross-Origin-Resource-Policy "same-origin"
</Location>

Express with Helmet defaults to same-origin since version 5, which is why a Helmet-protected app that serves fonts to other sites sometimes breaks; relax it deliberately:

app.use(helmet.crossOriginResourcePolicy({ policy: 'same-site' }));

Cloudflare: a Transform Rule scoped to a path expression can set the header for API routes only. Use same-site when subdomains of the same registrable domain need to share resources. If you plan to enable Cross-Origin-Embedder-Policy for cross-origin isolation, roll CORP out to your own subresources first, then audit third-party ones. The security headers guide summarises how COOP, COEP and CORP fit together.