Conversation

Julia Evans

@b0rk

Oct 4, 2021

CORS wizardzines.com/comics/cors/

667

3,127

Julia Evans

@b0rk

Oct 4, 2021

the same origin policy wizardzines.com/comics/same-or

431

This Tweet was deleted by the Tweet author. Learn more

Daniel Micay

@DanielMicay

Replying to

@b0rk

There's now Cross-Origin-Resource-Policy: same-origin for restricting non-CORP requests like <img> and Cross-Origin-Embedder-Policy: require-corp. Enabling and Cross-Origin-Embedder-Policy: require-corp and Cross-Origin-Opener-Policy: same-origin provides cross-origin isolation.

3:32 PM · Oct 4, 2021Twitter Web App

Replying to

and

Making your website "cross-origin isolated" using COOP and COEP

Some web APIs increase the risk of side-channel attacks like Spectre. To mitigate that risk, browsers offer an opt-in-based isolated environment called cross-origin isolated. Use COOP and COEP to set...