Cross-origin resources served by third-parties often do not include adequate CORP headers. If they can be requested without credentials, now you can enable cross-origin isolation by marking them as such.
 Eiji Kitamura [X](https://twitter.com/agektmr) [GitHub](https://github.com/agektmr) [Mastodon](https://infosec.exchange/@agektmr) [Bluesky](https://bsky.app/profile/agektmr.com)
> [!NOTE]
> **Note:** **Update, May 2022** `Cross-Origin-Embedder-Policy: credentialless` shipped and has been available in Chrome since 96. We've updated this article accordingly.
We have shipped the new Cross-Origin Embedder Policy (COEP) value
`credentialless` which allows the browser to load cross-origin resources which
don't use the Cross-Origin Resource Policy (CORP), by sending a request without
credentials, such as cookies. This helps developers to adopt cross-origin
isolation more easily.
## Why we need cross-origin isolation
Some web APIs increase the risk of side-channel attacks such as
[Spectre](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)). To
mitigate that risk, browsers offer an opt-in-based isolated environment called
[cross-origin isolation](https://web.dev/articles/coop-coep). With a cross-origin
isolated state, the webpage can use privileged features including
[`SharedArrayBuffer`](https://developer.chrome.com/blog/enabling-shared-array-buffer.md.txt),
[`performance.measureUserAgentSpecificMemory()`](https://web.dev/articles/monitor-total-page-memory-usage)
and [high-precision timers with better resolution](https://developer.chrome.com/blog/cross-origin-isolated-hr-timers.md.txt)
while isolating the origin from others unless they are opted in.
The webpage must send two HTTP headers to enable cross-origin isolation:
```console
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
```
With a cross-origin isolated state, all cross-origin resources must be served
with CORS or set a `Cross-Origin-Resource-Policy` header to be loaded.
## Challenges with enabling cross-origin isolation
While cross-origin isolation brings webpages better security and the ability to
enable powerful features, deploying it can be
[difficult](https://web.dev/articles/cross-origin-isolation-guide). One of the biggest
challenges is the requirement to enable CORS or CORP for all cross-origin
resources. Resources without those headers will not be loaded by the browser on
a cross-origin isolated page.
These cross-origin resources are usually served by third-parties for whom it may
not be easy to add the necessary headers.
But what if we know the resource is safe enough to be loaded? In fact, the only
resources that are at risk are ones requested with credentials, because they
potentially include sensitive information which the attacker can't load on their
own. This means resources that can be requested without credentials are publicly
available and safe to load.
## `credentialless` to the rescue
That's where `COEP: credentialless` comes in. `credentialless` is a new value
for the `Cross-Origin-Embedder-Policy` header. Similar to `require-corp`, it can
enable cross-origin isolation, but instead of requiring a `CORP:cross-origin`
header for no-cors cross-origin requests, they are instead sent without
credentials (for example, cookies).
You will be able to enable cross-origin isolation alternatively with the
following two headers:
```console
Cross-Origin-Embedder-Policy: credentialless
Cross-Origin-Opener-Policy: same-origin
```
This means the requested cross-origin server won't be able to respond with a
sensitive resource and the requester can always assume that the response only
contains publicly available information.
This is also aligned with browsers' plan of [phasing out third-party cookies](https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html).
## Demo
You can try various header options in this demo:
## FAQ
### Can I send a credentialed request under a `credentialless` environment?
Absolutely, at the cost of shifting the request's mode to require a CORS check
on the response. For HTML tags such as `