Seonglae ChoCross-Origin-Embedder-Policy: credentialless
I opt into isolation. Cross-origin isolation is a deal with the browser. Because of Spectre Attack, the browser locked away a few powerful features — SharedArrayBuffer, high-precision performance.now(), memory measurement. With precise timers and shared memory, you can read someone else's data in the same process through a side channel.
So the browser's condition is: “Prove that no one else's data entered your process without permission, and I'll unlock them.” The proof comes from two headers:
- cross-origin-opener-policy: same-origin ← I don't share a process with other windows
- cross-origin-embedder-policy: credentialless ← everything I load is something I was allowed to load
So COEP is the promise: "I guarantee that everything I load has permitted itself to be loaded by me." And anything that hasn't given permission is simply blocked.