Generator

COOP / COEP / CORP Generator

Cross-Origin-Opener-Policy + Cross-Origin-Embedder-Policy + Cross-Origin-Resource-Policy. Required for SharedArrayBuffer, WebAssembly threads, and high-res timers.

COOP

unsafe-none

Default. No isolation.

same-origin-allow-popups

Isolate from other origins, but popups still work.

same-origin

Strict same-origin isolation. Needed for cross-origin isolation.

COEP

unsafe-none

Default. No restrictions.

credentialless

Subresources load with omitted credentials. Easier deployment than require-corp.

require-corp

Subresources must opt in via CORP. Strict, enables crossOriginIsolated.

CORP (per-resource)

same-origin

Only same-origin pages can load this.

same-site

Same-site (subdomains OK).

cross-origin

Any origin can load — needed for CDN assets.

Headers

# Apply on top-level documents to enable cross-origin isolation
# (required for SharedArrayBuffer, WebAssembly threads, high-res timers)

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

# Apply on individual resources (images, scripts) to opt in
# Required on every cross-origin subresource if COEP=require-corp
Cross-Origin-Resource-Policy: same-origin