---
title: "ERR_BLOCKED_BY_RESPONSE.NotSameOrigin Helmet"
date: 2022-10-14T16:55:37.000Z
author: Z.SHINCHVEN
tags: [helmet, Cross Origin Resource Policy, CORP]
canonical: https://atlassc.net/2022/10/15/helmet-ERR_BLOCKED_BY_RESPONSE-NotSameOrigin
---
If you get `ERR_BLOCKED_BY_RESPONSE.NotSameOrigin` error when loading resource from an express app using `Helmet@^5.0.0`, 
because the `Cross-Origin-Embedder-Policy` header is enabled by default. To allow it, you must add config to `Helmet`:

```js
app.use(
  helmet({
    crossOriginEmbedderPolicy: false,
    // ...
  })
);
```

## References

- [Cross-Origin-Embedder-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy)
- [CORP](https://web.dev/coop-coep/)
- [helmet](https://helmetjs.github.io/)