https://nalar.dev/tags/web-isolation/ Recent content in Web Isolation on Nalar Hugo en-us Wed, 23 Sep 2026 00:00:00 +0000 https://nalar.dev/cross-origin-resource-policy-limits-no-cors-embedding/ Wed, 23 Sep 2026 00:00:00 +0000 https://nalar.dev/cross-origin-resource-policy-limits-no-cors-embedding/ <h1 id="cross-origin-resource-policy-limits-no-cors-embedding">Cross-Origin-Resource-Policy Limits No-CORS Embedding</h1> <p>Many browser elements can request resources across origins without using CORS. Images, scripts, media, and other subresources can travel through <code>no-cors</code> fetch paths where the page does not receive normal script-level access to the response body. That restriction is useful, but an unwanted cross-origin load can still expose a resource to embedding or side-channel conditions.</p> <p>The <code>Cross-Origin-Resource-Policy</code> response header, commonly shortened to CORP, lets the resource owner state which site relationship is allowed for those <code>no-cors</code> loads.</p> https://nalar.dev/origin-agent-cluster-separates-origin-keyed-javascript-heaps/ Wed, 23 Sep 2026 00:00:00 +0000 https://nalar.dev/origin-agent-cluster-separates-origin-keyed-javascript-heaps/ <h1 id="origin-agent-cluster-separates-origin-keyed-javascript-heaps">Origin-Agent-Cluster Separates Origin-Keyed JavaScript Heaps</h1> <p>Web origins that share a site can still belong to different security principals. <code>app.example.com</code> and <code>admin.example.com</code>, for example, have distinct origins even though both sit beneath the same registrable domain. Browser process architecture has historically allowed related origins to share an agent cluster in some cases, which can place their JavaScript execution environments closer together than an origin-only model suggests.</p> <p>The <code>Origin-Agent-Cluster</code> response header gives a document a way to request origin-keyed clustering:</p>