Skip to content
uencoder

COEP

COEP (Cross-Origin Embedder Policy) requires a page to load only same-origin resources or those with explicit cross-origin permission (CORP/CORS), enabling cross-origin isolation.

Purpose

To enable cross-origin isolation for SharedArrayBuffer and other high-precision timers, preventing Spectre side-channel leaks through cross-origin resources.

Mechanism

COEP: require-corp requires every cross-origin resource to carry a CORP: cross-origin or CORS header, otherwise loading is refused. The credentialless variant drops the CORP requirement but forbids credentials. Combined with COOP it enables crossOriginIsolated.

Use cases

  • Spectre defense
  • Cross-origin isolation
  • SharedArrayBuffer security

Related tools

HTTP Status Codes
Reference table of common HTTP status codes (1xx-5xx) with names, categories, and descriptions. Free, private, and 100% client-side.
TOOL
URL Parser
Parse a URL into its components: protocol, host, path, query, hash, port, username, and password. Free, private, and 100% client-side.
TOOL

References