Enable and debug cross-origin isolated
summary
Explains how to make a site crossOriginIsolated by sending two headers: COOP: same-origin on top-level documents and COEP: require-corp on frames, which enables SharedArrayBuffer and performance.memory and defends against Spectre-style leaks. Chrome DevTools in Chrome 88 shows isolation state in Application and flags blocked loads in Issues (example: four service resources blocked for missing CORP/CORS). Reporting and report-only headers send live reports; COOP reporting requires an origin trial. Popups without matching headers lose opener access.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:13Enabling Cross-Origin Isolated
- 2:39Devtools Functionalities
- 4:02Support for Co-App
- 4:40Enable Reporting
- 5:01Report Only Mode
- 5:15Enable Report Only Mode
- 5:41Additional Support and Devtools for Reporting Mode
- 6:56Enable Co-Op Enclap in Report-Only Mode
- 7:17Setting the Right Headers
related talks
16mFrom security as opt-in to security by default
37mA Hipster History of CORS
29mSame-Origin Policy: Evaluation in Modern Browsers
30mAchieving the Web Isolation Nirvana - How far along are we?
27mCode-Origin Policy: Towards a Formal User Privacy Protection for the Web
16mOpen web standards with Privacy Sandbox
26mTalking to Browsers with CORS
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features