Browser & Web Performance · Senior · Question 3 of 75

Which pair of headers makes a page cross-origin isolated (`self.crossOriginIsolated === true`)?

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

1CORS Access-Control-Allow-Origin: * plus HSTS
2CSP default-src 'self' plus X-Frame-Options: DENY
✓Correct answer: COOP same-origin plus COEP require-corp (or credentialless)

Explanation

COOP severs the window relationship with cross-origin popups; COEP requires every subresource to opt in via CORS or CORP.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.