Load cross-origin resources without CORP headers using COEP: credentialless  |  Blog  |  Chrome for Developers Skip to main content Docs Build with Chrome Learn how Chrome works, participate in origin trials, and build with Chrome everywhere. Web Platform Capabilities ChromeDriver Extensions Chrome Web Store Chromium Web on Android Origin trials Release notes Productivity Create the best experience for your users with the web's best tools. DevTools Lighthouse Chrome UX Report Accessibility Modern Web Guidance Get things done quicker and neater, with our ready-made libraries. Workbox Puppeteer Experience Design a beautiful and performant web with Chrome. AI Performance CSS and UI Identity Payments Privacy and security Resources More from Chrome and Google. All documentation Baseline web.dev PageSpeed Insights audit Isolated Web Apps (IWA) Case studies Blog New in Chrome / English Deutsch Español – América Latina Français Indonesia Italiano Nederlands Polski Português – Brasil Tiếng Việt Türkçe Русский עברית العربيّة فارسی हिंदी বাংলা ภาษาไทย 中文 – 简体 中文 – 繁體 日本語 한국어 Sign in Blog Docs More Case studies Blog New in Chrome Build with Chrome Web Platform Capabilities ChromeDriver Extensions Chrome Web Store Chromium Web on Android Origin trials Release notes Productivity DevTools Lighthouse Chrome UX Report Accessibility Modern Web Guidance Workbox Puppeteer Experience AI Performance CSS and UI Identity Payments Privacy and security Resources All documentation Baseline web.dev PageSpeed Insights audit Isolated Web Apps (IWA) Chrome for Developers Blog Load cross-origin resources without CORP headers using COEP: credentialless Stay organized with collections Save and categorize content based on your preferences. Cross-origin resources served by third-parties often do not include adequate CORP headers. If they can be requested without credentials, now you can enable cross-origin isolation by marking them as such. Eiji Kitamura X GitHub Mastodon Bluesky Note: Update, May 2022 Cross-Origin-Embedder-Policy: credentialless shipped and has been available in Chrome since 96. We've updated this article accordingly. We have shipped the new Cross-Origin Embedder Policy (COEP) value credentialless which allows the browser to load cross-origin resources which don't use the Cross-Origin Resource Policy (CORP), by sending a request without credentials, such as cookies. This helps developers to adopt cross-origin isolation more easily. Why we need cross-origin isolation Some web APIs increase the risk of side-channel attacks such as Spectre. To mitigate that risk, browsers offer an opt-in-based isolated environment called cross-origin isolation. With a cross-origin isolated state, the webpage can use privileged features including SharedArrayBuffer, performance.measureUserAgentSpecificMemory() and high-precision timers with better resolution while isolating the origin from others unless they are opted in. The webpage must send two HTTP headers to enable cross-origin isolation: Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin With a cross-origin isolated state, all cross-origin resources must be served with CORS or set a Cross-Origin-Resource-Policy header to be loaded. Challenges with enabling cross-origin isolation While cross-origin isolation brings webpages better security and the ability to enable powerful features, deploying it can be difficult. One of the biggest challenges is the requirement to enable CORS or CORP for all cross-origin resources. Resources without those headers will not be loaded by the browser on a cross-origin isolated page. These cross-origin resources are usually served by third-parties for whom it may not be easy to add the necessary headers. But what if we know the resource is safe enough to be loaded? In fact, the only resources that are at risk are ones requested with credentials, because they potentially include sensitive information which the attacker can't load on their own. This means resources that can be requested without credentials are publicly available and safe to load. credentialless to the rescue That's where COEP: credentialless comes in. credentialless is a new value for the Cross-Origin-Embedder-Policy header. Similar to require-corp, it can enable cross-origin isolation, but instead of requiring a CORP:cross-origin header for no-cors cross-origin requests, they are instead sent without credentials (for example, cookies). You will be able to enable cross-origin isolation alternatively with the following two headers: Cross-Origin-Embedder-Policy: credentialless Cross-Origin-Opener-Policy: same-origin This means the requested cross-origin server won't be able to respond with a sensitive resource and the requester can always assume that the response only contains publicly available information. This is also aligned with browsers' plan of phasing out third-party cookies. Demo You can try various header options in this demo: https://cross-origin-isolation.glitch.me FAQ Can I send a credentialed request under a credentialless environment? Absolutely, at the cost of shifting the request's mode to require a CORS check on the response. For HTML tags such as <audio>, <img>, <link>, <script>, and <video>, just append crossorigin="use-credentials" explicitly to inform the browser to send credentialed requests. For example, even if a document on https://www.example.com has Cross-Origin-Embedder-Policy: credentialless header, <img src="https://images.example.com/avatar.png" crossorigin="use-credentials"> will send a credentialed request. For the fetch() API, request.mode = 'cors' can be used. Provided COEP: credentialless, how is COEP: require-corp still useful for my website? COEP: require-corp doesn't require you to manually switch the request mode to CORS if cookies are needed for some cross-origin subresources. Can I also load cross-origin iframes without special headers under a credentialless environment? No. Loading cross-origin iframes under a credentialless environment still requires the same conditions as require-corp. iframe documents need to be served with two headers: Cross-Origin-Embedder-Policy: credentialless (or require-corp) Cross-Origin-Resource-Policy: cross-origin The good news is, there's an ongoing discussion about allowing loading cross-origin iframes without those headers by giving iframes crossorigin="anonymous". This will allow cross-origin iframes being loaded without headers but without credentials. Will this feature be adopted by other browsers? Firefox tracking issue Webkit Request for position: No signal W3C TAG Request for position: Pending What's coming next There are two additional updates coming to mitigate other challenges related to cross-origin isolation: COOP: same-origin-allow-popups-plus-coep Anonymous iframes Those who registered for the Chrome origin trial to extend the SharedArrayBuffer change due to the above obstacles might be wondering when it will be terminated. Originally we announced that it will be terminated in Chrome 96, but we have decided to postpone this to Chrome 106. Resources Making your website "cross-origin isolated" using COOP and COEP Why you need "cross-origin isolated" for powerful features A guide to enable cross-origin isolation SharedArrayBuffer updates in Android Chrome 88 and Desktop Chrome 92 Photo by Martin Adams on Unsplash Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates. Last updated 2021-07-29 UTC. [[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2021-07-29 UTC."],[],[]] Contribute File a bug See open issues Related content Chromium updates Case studies Archive Podcasts & shows Follow @ChromiumDev on X YouTube Chrome for Developers on LinkedIn RSS Terms Privacy Manage cookies English Deutsch Español – América Latina Français Indonesia Italiano Nederlands Polski Português – Brasil Tiếng Việt Türkçe Русский עברית العربيّة فارسی हिंदी বাংলা ภาษาไทย 中文 – 简体 中文 – 繁體 日本語 한국어