Web Security · Senior · Question 20 of 75

Which two headers make a page cross-origin isolated?

1Access-Control-Allow-Origin and Vary
2Strict-Transport-Security and X-Frame-Options
✓Correct answer: Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp (or credentialless)

Explanation

Isolation gives the page its own process and enables features like SharedArrayBuffer and precise timers, which need protection from Spectre.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.