Cross-Origin-Embedder-Policy
ResponseActiveCross-Origin-Embedder-Policy (COEP) controls which cross-origin resources can be loaded by a document. 'require-corp' requires all subresources to explicitly opt in via CORS or the Cross-Origin-Resource-Policy header. Together with COOP: same-origin, COEP enables cross-origin isolation – required for SharedArrayBuffer and accurate performance timers.
Cross-Origin-Embedder-Policy: unsafe-none | require-corp | credentialless
Description
COEP enforces that every embedded resource either has a CORS header or a Cross-Origin-Resource-Policy: cross-origin header. This prevents Spectre-style side-channel attacks that read cross-origin data via SharedArrayBuffer timing. Setting COEP: require-corp will break any third-party resources that don't send the required headers – common pitfall with CDN-served images, fonts, and iframes.
Directives
| Directive | Description |
|---|---|
| unsafe-none | Default. Cross-origin resources can load without restrictions. |
| require-corp | All cross-origin resources must have CORS or CORP headers. |
| credentialless | Cross-origin no-cors requests made without credentials. More permissive than require-corp. |
Examples
Cross-origin isolation
http
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
# Now SharedArrayBuffer is availableCORP on subresource
http
# Resource server must send:
Cross-Origin-Resource-Policy: cross-origin