Browser & Web Performance · Senior · Question 6 of 75

What is `Cross-Origin-Resource-Policy: same-site` for?

1Allows other sites to read the response with fetch
✓Correct answer: Prevents other sites from loading this resource with no-cors requests, like <img> or <script>
3Sets the default SameSite value for cookies

Explanation

CORP protects resources from being pulled into an attacker's process, where speculative execution could leak them.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.