[HTTP header] Cross-Origin-Resource-Policy

[Malvoz]

• https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy
  (+ https://developer.mozilla.org/en-US/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP))

The Cross-Origin-Resource-Policy (CORP) header enables authors to prevent other domains from loading resources by restricting any kind of cross-origin load to protect themselves against Spectre attacks (essentially a standardized method of hotlink protection).

Available in Safari 12.

Tracking bugs:

• https://www.chromestatus.com/feature/4647328103268352
• https://bugzilla.mozilla.org/show_bug.cgi?id=1459573
• https://bugs.webkit.org/show_bug.cgi?id=186761
• https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/17934554/

Note, this header was initially proposed as From-Origin, can include it in keywords for developers to find the latest version.

[Malvoz]

We should note the bug in Chrome 73 with regards to downloads of resources that include this header in the response: https://bugs.chromium.org/p/chromium/issues/detail?id=952834

[Fyrd]

Available at https://caniuse.com/#feat=mdn-http_headers_cross-origin-resource-policy