demo · v137

Document-Isolation-Policy

A single response header that opts a document into its own agent cluster and Spectre-isolation — without requiring coordinated COOP/COEP across every subresource. The probes below read the actual cross-origin-isolated state your browser has granted this page right now.

Heads upTo grant cross-origin isolation, the server must send Document-Isolation-Policy: isolate-and-credentialless. This static page can't change its own headers, so the probes will typically read not isolated. The probe code itself is the demo.

probing…

crossOriginIsolated—

SharedArrayBuffer ctor—

performance.measureUserAgentSpecificMemory()—

high-resolution timers—

no actions yet

the code

// Server response headers:
Document-Isolation-Policy: isolate-and-credentialless

// Client checks:
console.log(window.crossOriginIsolated);   // true once the header lands
new SharedArrayBuffer(64);                 // throws unless isolated
await performance.measureUserAgentSpecificMemory(); // isolated-only

the code

see also