COOP and COEP Turn Cross-Origin Isolation into a Document-Group Boundary
COOP and COEP Turn Cross-Origin Isolation into a Document-Group Boundary A web page can be same-origin with its own application code while still maintaining relationships with cross-origin popups, frames, workers, and resources. Those relationships matter when a browser decides which documents can occupy the same browsing context group and which capabilities can be exposed safely. Cross-origin isolation changes that arrangement through two response policies with different jobs. Cross-Origin-Opener-Policy (COOP) controls top-level opener relationships and browsing context group switches. Cross-Origin-Embedder-Policy (COEP) constrains the cross-origin resources a document and its descendants may load. Used together in the configuration required for isolation, they establish a browser-enforced boundary that is broader than the same-origin policy alone.