Not every cross-origin data leak uses a script tag or a CORS misconfiguration. Browsers load images, audio, video, fonts, and other media through request modes that can avoid a CORS preflight. A server may return a sensitive response with a media-looking content type, and a page can try to infer information from decoding, dimensions, timing, or error behavior. Opaque Response Blocking, usually shortened to ORB, adds a browser-side check before that response is exposed to the requesting context.

The Fetch Standard describes opaque filtered responses and response blocking behavior. The security goal is to prevent a cross-origin response from being used as a same-origin-readable resource when the response does not have the right CORS or resource-policy permission. ORB is relevant to defenders because it changes the assumptions around no-cors media requests and because it interacts with MIME sniffing and endpoint design.

Why media requests need a separate view

A normal fetch() call that needs to read cross-origin data goes through CORS. A request for an image or audio resource may use no-cors mode because the caller only needs to load the resource, not read its body. The browser still receives bytes and must decide whether they can be treated as a media resource. If the response looks like a document, JSON, or another opaque data type, the browser can block the response instead of exposing it to the embedding page.

This is a defense against a class of attacks where a public endpoint returns user-specific data but an attacker uses a side-effect or media element to cause a cross-origin request. The attacker does not need to read the body if the browser's loading behavior reveals enough. Correct MIME types and ORB reduce the number of responses that can be used this way.

The server controls that still matter

ORB is not an authorization layer. A sensitive endpoint must still require authentication and enforce object-level authorization. Return a generic error for unauthorized requests and avoid placing secrets in response headers or error text that a media element can observe. Set Content-Type accurately and add X-Content-Type-Options: nosniff where the deployment supports it. Do not use an image or JSON content type as a disguise for another format.

Cross-Origin-Resource-Policy gives the resource owner an explicit policy for embedding. A same-origin policy is appropriate for many internal resources. CORS remains the right mechanism for public or intentionally shared APIs. The controls are complementary: CORP and CORS state who may use the response, while ORB blocks responses that do not meet the browser's safe opaque-response rules.

Test the actual response shape

Use a browser with current ORB behavior and test from a distinct origin. Include the same authentication state, headers, redirects, and content negotiation that production uses. Check image loads, media elements, fetch calls, and error events. A response that works in a command-line HTTP client may fail in a browser because the browser evaluates response metadata and request mode differently.

Test JSON endpoints that return a login page, a single sign-on redirect, or an HTML error page. These are common sources of MIME confusion. Test public file endpoints that return user-controlled content. An attacker may control the first bytes or extension, so a correct declared type must still be backed by safe parsing and storage.

Monitoring and rollout

Review browser reports for blocked responses and correlate them with application errors. Do not silently disable a security header to fix a compatibility issue until the affected resource and user population are understood. If a legitimate cross-origin integration needs data, use CORS with explicit origins and credentials rather than relying on an opaque media request.

ORB is a good example of a browser control that narrows an old attack surface without requiring application teams to rewrite every endpoint. The remaining work is familiar: correct MIME types, explicit cross-origin policy, strong authentication, and tests that exercise real browser behavior.

References