Cross-Origin-Embedder-Policy (COEP) Explained
COEP controls whether a document can load cross-origin resources that do not explicitly opt in. Learn require-corp vs credentialless, pairing with COOP, and why many sites ship COOP without COEP.
Cross-Origin-Embedder-Policy (COEP) is a response header that requires cross-origin subresources to explicitly permit being embedded — typically via CORP or CORS — before the document can load them. Strict COEP unlocks certain powerful APIs (notably some SharedArrayBuffer scenarios) at the cost of breaking embeds that never opted in.
PatchPings documents and ships COOP (same-origin-allow-popups) on the marketing site. PatchPings does not enable COEP site-wide. This guide explains COEP so you can decide for your own apps without assuming our headers match a full cross-origin isolation stack.
Common COEP values
- `unsafe-none` — default; no embedder restrictions from COEP.
- `require-corp` — cross-origin resources must send CORP (or be CORS-same-origin) to load.
- `credentialless` — newer mode that loads cross-origin no-CORS resources without credentials; still stricter than unsafe-none.
Cross-Origin-Embedder-Policy: require-corp
COEP needs friends
Full cross-origin isolation usually pairs COEP with COOP (same-origin) and often CORP on your own assets. Enabling COEP alone on a page full of third-party scripts, fonts, and pixels will blank parts of the UI until every dependency opts in.
List every cross-origin script, image, frame, and worker. If a vendor cannot send CORP or CORS, you cannot keep require-corp without replacing them.
When COEP is worth it
- 1You need APIs that require cross-origin isolation.
- 2You control (or can replace) every embedded origin.
- 3You can test auth, analytics, and support widgets under the new policy.
- 4You accept operational cost for a specific app surface — not necessarily the marketing site.
COEP is a sharp tool. Prefer shipping COOP first as PatchPings does, add CORP on first-party assets when you are ready, and only enable COEP when you have a concrete isolation requirement and a clean embed inventory.
