Skip to content
iframecheck

Cross-Origin-Embedder-Policy

Cross-Origin-Embedder-Policy (COEP) is an HTTP response header that controls which cross-origin resources a page may load. With require-corp, each cross-origin resource must allow the load with CORS or a Cross-Origin-Resource-Policy header.

HTTP header

Also called COEP

Updated

On this page

How it works

COEP goes on the page that loads the content. With require-corp, the browser blocks a cross-origin no-cors load, such as an <img> without the crossorigin attribute. The load works only when the response sends a Cross-Origin-Resource-Policy header that allows it. A load in cors mode must pass CORS instead.

COEP also applies to frames. When the parent sends require-corp or credentialless, the framed page must also send one of these values. A cross-origin framed page must also send Cross-Origin-Resource-Policy: cross-origin.

Values

ValueCross-origin no-cors resources
unsafe-none (default)Load without consent.
require-corpLoad only when a Cross-Origin-Resource-Policy header allows it.
credentiallessLoad without a Cross-Origin-Resource-Policy header, but with no cookies.

The browser reads COEP only in a secure context, such as an HTTPS page. A value it cannot read counts as unsafe-none. Two COEP headers in one response also count as unsafe-none.

Example

HTTP response headers
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin

Together, these two headers make the page cross-origin isolated. Read window.crossOriginIsolated in a script to check it.

How to set it

Send COEP from the page that loads the content. Each cross-origin page you put in a frame must also opt in, as the last tab shows.

Cross-Origin-Embedder-Policy: require-corp

The browser blocks a cross-origin frame that does not send these headers. The credentialless attribute on the iframe lifts this rule. The frame then loads in a new context, without its cookies and storage.

Learn more

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.

Test a URLBrowse guides