HTTP Security Headers

Cross-Origin-Embedder-Policy (COEP)

Requires every cross-origin resource your page loads to explicitly opt in, which — paired with COOP — makes the page cross-origin isolated.

What it is

Cross-Origin-Embedder-Policy (COEP) changes how a document may embed cross-origin content. Under require-corp, every cross-origin resource — images, scripts, fonts, frames — must explicitly permit embedding via a Cross-Origin-Resource-Policy header or a successful CORS check, or the browser refuses to load it.

Values

unsafe-none
Default. Cross-origin resources load with no opt-in requirement.
require-corp
Cross-origin resources must opt in via CORP or CORS, or they are blocked.
credentialless
Cross-origin no-CORS requests are sent without credentials, avoiding the need for CORP on every subresource.
HTTP RESPONSE HEADERS
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin

The other half of cross-origin isolation

COEP: require-corp plus COOP: same-origin makes self.crossOriginIsolated true, re-enabling SharedArrayBuffer and high-precision timers that were disabled after Spectre.

Why it matters

  • It is required (with COOP) to reach cross-origin isolation and use SharedArrayBuffer, WASM threads and precise timers.
  • It ensures every embedded cross-origin resource has explicitly consented to being loaded, closing a speculative-execution side-channel.
  • credentialless offers a lower-friction path to isolation without changing every third-party subresource.

Common mistakes

  • Enabling require-corp without auditing third-party resources first, which then all fail to load and break the page.
  • Forgetting that COEP does nothing for isolation unless COOP is also same-origin.
  • Assuming existing CDNs send CORP — many do not, so their assets are blocked under require-corp.

How WebInspect checks this

  • WebInspect reports the COEP value and pairs it with COOP to determine if the page is cross-origin isolated.
  • It flags require-corp pages likely to break if third-party assets lack CORP/CORS.
  • It recommends the COOP + COEP combination when it detects APIs that need isolation.