Cross-Origin-Resource-Policy on static assets

Without Cross-Origin-Resource-Policy on static assets, any origin can load your images, fonts, scripts, and other static files — including embedding them in pages that time their load to probe for authenticated-user-specific content. This Spectre-adjacent technique uses resource load timing differences to infer which assets a logged-in user has cached. CWE-1021 applies to unauthorized cross-origin resource embedding. OWASP A05 flags absent CORP headers as a misconfiguration gap in the cross-origin isolation stack — COEP without CORP on assets creates an isolation inconsistency.

Configure CORP headers on static asset routes in next.config.js. For private assets, use same-origin; for CDN-shared public assets, use cross-origin.

// next.config.js
headers: [{
  source: '/static/(.*)',
  headers: [{
    key: 'Cross-Origin-Resource-Policy',
    value: 'same-origin'
  }]
}]

For the public/ directory in Next.js, you may also need to configure CORP at the Vercel edge level via vercel.json headers rules, since Next.js static file serving bypasses next.config.js middleware for some asset paths.