demo · v137

DIP vs COOP+COEP

Document-Isolation-Policy isn't a replacement for COOP/COEP — it's a different shape. COOP+COEP demands every subresource opt-in via CORS/CORP and severs cross-origin popups. DIP relies on out-of-process iframes instead, so cross-origin popups and third-party embeds keep working. The matrix below is the actual trade-off Gmail/Meet/Zoom were waiting on.

probing…
capabilitybaselineCOOP + COEPDocument-Isolation-Policy
SharedArrayBuffernoyesyes
cross-origin postMessage to popupsyesseveredyes
cross-origin <img> / <script> without CORPyesblockedyes
3rd-party iframes without coordinated headersyesblocked (CORP needed)yes (out-of-process)
credentialled cross-origin requests inside the embedyesstrippedstripped (credentialless mode)
performance.measureUserAgentSpecificMemory()noyesyes

DIP server config

One header on the document. No coordination required across subresources or third-party widgets.

Document-Isolation-Policy: isolate-and-credentialless # That's it. Subresources stay vanilla. # <script src="https://cdn.example/sdk.js"></script> # <iframe src="https://3p-widget.example/embed"></iframe> # all keep loading without CORP / CORS handshakes.

COOP + COEP server config

Three headers on the document AND a CORP/CORS handshake on every subresource. Breaks popup messaging and most third-party SDKs.

Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-origin # Plus: every cross-origin asset must respond with either # Cross-Origin-Resource-Policy: cross-origin # or proper CORS headers. Anything that doesn't = broken. # Plus: window.open() to other origins returns disconnected.

live probe

Probe whether this page got isolation, and try the two breakage points side-by-side.

no actions yet

the code

// Probe state.
console.log(window.crossOriginIsolated);

// COOP+COEP page: window.open(otherOrigin) returns a window with
// opener=null and postMessage to it is dropped.
//
// DIP page: window.open(otherOrigin) keeps the connection.
//
// Both paths grant SharedArrayBuffer.

const sab = new SharedArrayBuffer(64);  // OK if isolated

see also