How to add the Cross-Origin-Resource-Policy header in Nginx

Nginx configuration (nginx server block)

add_header Cross-Origin-Resource-Policy "same-origin" always;

Place it in the server or location block, then run nginx -t and reload. add_header in a location block replaces headers set at server level, so repeat them where needed. The always flag sends the header on error responses too.

Before you deploy

Use same-site or cross-origin for assets that other sites or your CDN subdomains legitimately load.

Verify it works

curl -sI https://your-site.com | grep -i cross-origin-resource-policy

Or run a free Korrali Web scan to check this and every other security header at once.

Other headers in Nginx

• Strict-Transport-Security in Nginx
• Content-Security-Policy in Nginx
• X-Frame-Options in Nginx
• X-Content-Type-Options in Nginx
• Referrer-Policy in Nginx
• Permissions-Policy in Nginx
• Cross-Origin-Opener-Policy in Nginx