Agent WranglersAPS-30Recommended
Keep other sites' windows apart
Send Cross-Origin-Opener-Policy: same-origin and a Cross-Origin-Resource-Policy. These keep other sites' windows and pages away from yours. Add COEP only if you need full isolation.
How to do it
Send Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-site. Use same-origin-allow-popups on pages that open sign-in or payment popups. Use cross-origin on files meant to be shown on other sites. These include images in feeds and og:image files, which web feed readers and social sites load from their own origin. same-site blocks them there. Add Cross-Origin-Embedder-Policy: require-corp or credentialless only if you need cross-origin isolation, for example for SharedArrayBuffer. Test it with the attack in Send the security headers as one set.
Examples
HTTP example
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-siteHow to check
curl -sI shows both headers on pages and files. Every image a feed entry or an og:image tag names answers with Cross-Origin-Resource-Policy: cross-origin. Every page still loads its embeds, sign-in popups and payment popups in a browser test.
Sources
Related rules
- APS-100 Send the security headers as one set in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/browser-security-headers/cross-origin-isolation">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.