Skip to content
iframecheck

Frame blocked by COEP: NotSameOriginAfterDefaultedToSameOriginByCoep

Your own page sends Cross-Origin-Embedder-Policy: require-corp. A frame from another origin must then opt in with Cross-Origin-Resource-Policy and its own COEP header. This one does not, so the browser blocks it.

  • Chrome
  • Edge
  • Safari

Updated

Error code · Chrome and Edge, exact text

net::ERR_BLOCKED_BY_RESPONSE.NotSameOriginAfterDefaultedToSameOriginByCoep

Chrome, EdgeExact text

The frame shows a gray page: “example.com refused to connect.” The Network panel of DevTools gives the reason below.

(blocked:CORP not "same-origin" after defaulted to "same-origin" by COEP)

SafariExact text

The frame stays blank. There is no message in the page.

Refused to display 'https://example.com/' in a frame because of Cross-Origin-Embedder-Policy.

On this page

What it means

This time the parent page causes the block. It asks for cross-origin isolation with COEP, and the page in the frame does not say that it may be embedded in that mode. The browser keeps the promise of the parent page and blocks the frame.

Why it happens

Your page, the parent of the frame, sends this header:

Cross-Origin-Embedder-Policy: require-corp

  1. With require-corp, a frame from another origin needs Cross-Origin-Resource-Policy: cross-origin. Without it, Chrome treats the frame as same-origin and blocks it.

  2. If the framed page has no COEP header, the console code ends in .ResponseNeedsCrossOriginEmbedderPolicy. DevTools shows “COEP-framed resource needs COEP header”.

  3. Pages send require-corp, with Cross-Origin-Opener-Policy, to get cross-origin isolation, which SharedArrayBuffer needs.

  4. The Network panel of DevTools shows the reason in words: (blocked:CORP not "same-origin" after defaulted to "same-origin" by COEP).

Check the page

See the headers the page sends now

Fix it if you own the site

On the framed page, send the headers below. The browser checks the COEP value of the framed page. If you own only the parent page, give the iframe the credentialless attribute. The frame then loads without its cookies, and the browser lifts the COEP rule for it. Not every browser supports this attribute.

Response headers of the framed page
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Embedder-Policy: require-corp

Remove require-corp from the parent page if it does not need cross-origin isolation. That is the smallest change.

If you do not own the site

You own the parent page here, so you can fix it from your side. If you cannot change the framed page, use one of these.

  1. Add credentialless to the iframe

    The frame loads without its cookies, and the COEP rule does not apply to it.

  2. Drop require-corp

    Remove the COEP header if no feature of your page needs cross-origin isolation.

  3. Ask the owner

    Ask them to send Cross-Origin-Resource-Policy: cross-origin and a COEP header.

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.

Test a URLBrowse guides