Cross-Origin Isolation: COOP, COEP, CORP

Cross-origin isolation is a browser security state established by a family of headers — COOP, COEP, and CORP — that harden the boundaries between your origin and others. They emerged from the fallout of the Spectre CPU side-channel attacks, and they do double duty: strengthening isolation against cross-window attacks, and re-enabling powerful APIs that browsers had to disable.

What does each header do?#

Header	Purpose
COOP (Cross-Origin-Opener-Policy)	Severs the link between your page and windows it opens/that open it
COEP (Cross-Origin-Embedder-Policy)	Requires embedded cross-origin resources to opt in
CORP (Cross-Origin-Resource-Policy)	Lets a resource declare who may embed it

COOP with same-origin stops another site from keeping a JavaScript handle to your window (a vector for cross-window attacks and some information leaks). COEP with require-corp ensures every embedded resource has explicitly agreed to be loaded, closing side-channel avenues.

Why did isolation become necessary?#

Because Spectre showed that a malicious page sharing a process with your data could read it via CPU timing side channels. Browsers responded by disabling SharedArrayBuffer, precise timers, and similar features. Entering a cross-origin isolated state — by setting COOP and COEP — proves your page is safely separated, so the browser trusts it with those powerful APIs again:

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

These headers extend the same-origin policy and complement your security headers. More at the Web Security hub.