The four headers below — Cross-Origin-Opener-Policy,
Cross-Origin-Embedder-Policy, Cross-Origin-Resource-Policy,
and Origin-Agent-Cluster — are the browser's primary defense against
side-channel attacks such as Spectre. Set them correctly and your page enters
crossOriginIsolated mode, which unlocks
SharedArrayBuffer, high-resolution timers, and
performance.measureUserAgentSpecificMemory().
One card per header, with every spec-defined value, what it means, and when to use it.
crossOriginIsolated configClick the button to render the three-header combination that flips self.crossOriginIsolated to true.
What this does. Sends
Cross-Origin-Opener-Policy: same-origin,
Cross-Origin-Embedder-Policy: require-corp, and
Cross-Origin-Resource-Policy: same-origin. Once every subresource is
loaded with valid CORS or CORP headers, the browser sets
self.crossOriginIsolated === true.
What to check first. Every cross-origin script, image, font, and
iframe must either (a) be served with
Cross-Origin-Resource-Policy: cross-origin, or (b) be loaded with
crossorigin attributes and CORS. Anything that fails will be blocked
once COEP: require-corp is on.
The threat model and the capability tradeoff in one place.
self.crossOriginIsolated === true means the page can only talk to
other documents that opted in to the same COOP and COEP values. That cuts off the
side-channel a Spectre-style attack would otherwise be able to read.
Browsers disabled SharedArrayBuffer in 2018 after Spectre and
re-enabled it in 2020, but only for cross-origin-isolated pages. The same gate
unlocks high-precision performance.now() values (rounded to 5µs
instead of 1ms) and performance.measureUserAgentSpecificMemory().
Spectre lets a script read memory it should not have access to by exploiting timing differences in the CPU cache. COOP and COEP shrink the shared address space to a single origin, removing the side-channel.
credentialless
A newer alternative to require-corp. The browser sends
cross-origin subresource requests without cookies or client certificates, so
Access-Control-Allow-Origin: * responses are accepted. Useful when
you cannot get every third-party host to ship CORP.
same-origin-allow-popups
Lets you keep a reference to a popup you opened, without giving up the isolation
benefit. The opener and the popup share an agent cluster as long as the popup was
opened by user gesture, and you can still postMessage between them.
cross-origin
Send this on third-party assets so they can be embedded by a
require-corp page. same-site is a tighter alternative
when the asset should only load on the same registrable domain.
Where these headers sit next to the rest of the security baseline.
Audit a live URL to see whether COOP / COEP / CORP are already set, and at what values.
Pair the cross-origin trio with a strict Content-Security-Policy for full defense in depth.
The full HTTP response header rollout order, including when to opt into isolation.
Cross-origin isolation is a precondition for many of the features in Permissions-Policy.
Verify every third-party script before COEP: require-corp is enabled.
What to do when a third-party script refuses to load once you turn COEP on.