Glossary
SECURITY HEADERS

COOP + COEP

Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy — HTTP headers that isolate a page from cross-origin windows and require CORP-marked embeds. Prerequisite for SharedArrayBuffer.

COOP (Cross-Origin-Opener-Policy) and COEP (Cross-Origin-Embedder-Policy) together enable “cross-origin isolation” — a mode that makes a page eligible for high-precision APIs (SharedArrayBuffer, performance.now() at full resolution) blocked after the Spectre / Meltdown disclosures.

Header Format

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

What They Do

  • COOP — prevents cross-origin windows from sharing a browsing context group with your page. If someone window.open()s your page or your page opens a cross-origin page, the two windows can’t script each other.
  • COEP — requires every cross-origin resource (image, script, iframe) loaded by the page to explicitly opt in via Cross-Origin-Resource-Policy: cross-origin or CORS headers.

Trade-off

Enabling COOP + COEP breaks any embed that doesn’t opt in — analytics, ads, third-party fonts, widgets. Deploy in report-only mode first (Cross-Origin-Opener-Policy-Report-Only, Cross-Origin-Embedder-Policy-Report-Only), fix reported violations, then flip to enforcing.

When to Deploy

Enable if:

  • You need SharedArrayBuffer (WebAssembly threads, some video codecs, some crypto libraries)
  • You need high-resolution performance.now() for profiling
  • Otherwise, skip until required

Check your isolation state with the security headers audit.

Check the CSP glossary entry, the CORS glossary entry, and read the HTTP security headers explainer.

← All terms Learning hub →