demo · v132

COOP + COEP vs. DIP — pick the right one

Three ways to opt into cross-origin isolation. The COOP+COEP duo gets all the press but breaks every cross-origin subresource you don't have a CORP header on. DIP picks one of two backstops: credentialless or require-corp. Side-by-side comparison.

yes partial no effects below are what each policy unlocks for the document and its iframes

COOP + COEP

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
crossOriginIsolated flips true
SharedArrayBuffer available
high-resolution timers
cross-origin subresources without CORP header
popups stay in same browsing context group? severs them
credentials sent on cross-origin requests

complexity: high. needs CORP headers on every cross-origin asset. breaks ad SDKs.

DIP isolate-and-credentialless

Document-Isolation-Policy: isolate-and-credentialless
crossOriginIsolated flips true
SharedArrayBuffer available
high-resolution timers
cross-origin subresources load (without credentials)
popups stay in their group (no COOP severing)
credentials sent on cross-origin requests

complexity: low. one header, no CORP audit. price: cookies stripped.

DIP isolate-and-require-corp

Document-Isolation-Policy: isolate-and-require-corp
crossOriginIsolated flips true
SharedArrayBuffer available
high-resolution timers
cross-origin subresources without CORP header
popups stay in their group (no COOP severing)
credentials sent (CORP present)

complexity: medium. still need CORP, but no COOP audit.

verdict. If you have a workload that needs SharedArrayBuffer — ffmpeg.wasm, OPFS image compressors — but you also embed third-party ads, social widgets, or analytics that don't and won't ship CORP headers: DIP isolate-and-credentialless. If you can audit all your subresources and want credentials too: DIP isolate-and-require-corp. The old COOP+COEP combo remains valid but now lives in the "highest-friction" tier.

see also

scenario focus

Select a scenario to focus its rendered example and summary.