Gera Tools

COEP / CORP / COOP Headers Reference

Cross-Origin Embedder, Resource, Opener Policy headers with isolation model.

Reference for the COEP, CORP and COOP cross-origin isolation headers, their accepted values and how they combine to enable crossOriginIsolated and SharedArrayBuffer.

What unlocks crossOriginIsolated?

A document is cross-origin isolated only when it sends both Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp (or credentialless). Once isolated, window.crossOriginIsolated is true and SharedArrayBuffer and high-resolution timers become available.

Earning cross-origin isolation

Powerful web APIs such as SharedArrayBuffer and unthrottled performance.now() are gated behind cross-origin isolation. A document earns it by combining three headers — Cross-Origin-Opener-Policy (COOP), Cross-Origin-Embedder-Policy (COEP) and, on its subresources, Cross-Origin-Resource-Policy (CORP). This reference covers each header’s values and computes whether a given COOP/COEP pair isolates the page.

How it works

COOP controls the document’s browsing-context group; COEP controls how it may embed cross-origin resources; CORP is set by each resource to declare who may embed it:

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: cross-origin

Isolation is granted only when the top-level document sends COOP: same-origin and COEP: require-corp or credentialless. With require-corp, every cross-origin subresource must opt in with a CORP header (or be loaded via CORS) or the browser blocks it. credentialless relaxes that by loading no-CORS cross-origin resources without credentials.

Tips and notes

  • Both COOP and COEP must be present and correct — one alone does nothing.
  • Audit subresources before enabling COEP; missing CORP/CORS will break images, scripts and fonts.
  • COOP: same-origin-allow-popups keeps opener for popups you open but does not enable isolation.
  • Check self.crossOriginIsolated at runtime to confirm the page is isolated.
  • Prefer credentialless for faster rollout when you cannot add CORP to every dependency.