topic
Verified 2026-09-18

COOP, COEP, and CORP

Headers that control cross-origin window relationships, embedding, and resource loading.

Use Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, and Cross-Origin-Resource-Policy together only when the application has tested its cross-origin dependencies.

httpsecuritycross-origin

Reference (http)

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-origin

Use Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, and Cross-Origin-Resource-Policy together only when the application has tested its cross-origin dependencies.

Common mistakes

  • Enabling cross-origin isolation without auditing workers, images, scripts, and third-party embeds.

Sources

Permalink: https://merginit.com/reference/http/cross-origin-isolation