How Cross-Origin-Embedder-Policy works
With require-corp, the page can only load cross-origin images, scripts and frames that send CORS headers or Cross-Origin-Resource-Policy: cross-origin. Together with COOP same-origin, it makes the page cross-origin isolated, which unlocks SharedArrayBuffer (needed by multithreaded WebAssembly such as ffmpeg.wasm). credentialless is an easier mode: cross-origin requests are sent without cookies instead of being blocked.
Examples
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corpCommon mistakes
-
Check
self.crossOriginIsolatedin the console to confirm isolation is active.
Check it
curl -sI https://example.com | grep -i '^cross-origin-embedder-policy:'Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.
Related headers
- Cross-Origin-Opener-Policy: separates your page from cross-origin windows it opens or is opened by (COOP).
- Cross-Origin-Resource-Policy: says which sites may load this resource with no-cors requests such as <img> and <script> (CORP).
- Access-Control-Allow-Origin: tells the browser which origin may read a cross-origin response.
More security headers
Content-Security-Policy , Strict-Transport-Security , X-Content-Type-Options , X-Frame-Options , Referrer-Policy , Permissions-Policy .
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does the Cross-Origin-Embedder-Policy header do?
The Cross-Origin-Embedder-Policy response header requires every cross-origin resource a page loads to opt in to being embedded (COEP). With require-corp, the page can only load cross-origin images, scripts and frames that send CORS headers or Cross-Origin-Resource-Policy: cross-origin. Together with COOP same-origin, it makes the page cross-origin isolated, which unlocks SharedArrayBuffer (needed by multithreaded WebAssembly such as ffmpeg.wasm). credentialless is an easier mode: cross-origin requests are sent without cookies instead of being blocked.
How do I see the Cross-Origin-Embedder-Policy header?
Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.