Agent Wranglers

Security Recommended

Keep other sites' windows apart

Send Cross-Origin-Opener-Policy: same-origin and a Cross-Origin-Resource-Policy. These keep other sites' windows and pages away from yours. Add COEP only if you need full isolation.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Send Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-site. Use same-origin-allow-popups on pages that open sign-in or payment popups. Use cross-origin on files meant to be embedded elsewhere. Add Cross-Origin-Embedder-Policy: require-corp or credentialless only if you need cross-origin isolation, for example for SharedArrayBuffer.

Example

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-site

How to check

curl -sI shows both headers on pages and files. Every page still loads its embeds, sign-in popups and payment popups in a browser test.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/cross-origin-isolation.