demo · v137

Policy builder

Pick a Document-Isolation-Policy value plus a few embed shapes — the builder spits out the exact HTTP headers, decides whether crossOriginIsolated turns on, and tells you which subresources will load vs blocked. Compare DIP head-to-head with the COOP+COEP route below.

your policy

page composition

generated response headers

…

verdicts

capability switches

crossOriginIsolated—
SharedArrayBuffer—
performance.measureUserAgentSpecificMemory()—
process isolation—

resource loading

cross-origin <img> (no CORS)—
cross-origin <iframe>—
cross-origin window.open() popup—
same-origin window.opener access—

DIP vs COOP+COEP

Document-Isolation-Policy delivers the same crossOriginIsolated capability without breaking your popups or third-party iframes — the trade is that you only get isolation, not the full cross-origin opener policy.

COOP+COEP route (existing)

Coordinated with embedders?required
Breaks cross-origin popups?yes
crossOriginIsolated?yes

Document-Isolation-Policy

Coordinated with embedders?no
Breaks cross-origin popups?no
crossOriginIsolated?yes

see also