home/headers/cross-origin-embedder-policy

Cross-Origin-Embedder-Policy

response headersecurity

Requires the resources a page loads to opt in to being embedded — the second half of cross-origin isolation.

With require-corp, a page can only load cross-origin resources that explicitly allow it, through CORS or a Cross-Origin-Resource-Policy header. Combined with Cross-Origin-Opener-Policy: same-origin, that makes the page cross-origin isolated, which unlocks SharedArrayBuffer and high-resolution timers — needed by multithreaded WebAssembly apps such as ffmpeg.wasm.

Syntax

Cross-Origin-Embedder-Policy: unsafe-none | require-corp | credentialless

Defined in HTML Standard — Cross-origin embedder policies.

Values

unsafe-none	the default: no restrictions
require-corp	cross-origin resources must opt in with CORS or CORP
credentialless	cross-origin no-cors requests are sent without cookies instead of being blocked

Examples

Cross-Origin-Embedder-Policy: require-corp

strict; every cross-origin resource must opt in

Cross-Origin-Embedder-Policy: credentialless

easier with third-party images and scripts that don't send CORP

Good to know

Run self.crossOriginIsolated in the console to confirm isolation is on.
Third-party embeds — ads, video iframes, analytics pixels — often break under require-corp. credentialless avoids much of that; check browser support for your audience.
Test first with Cross-Origin-Embedder-Policy-Report-Only.

How to set Cross-Origin-Embedder-Policy

Express

res.set("Cross-Origin-Embedder-Policy", "require-corp");

Next.js (next.config.js)

module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Cross-Origin-Embedder-Policy", value: "require-corp" }],
      },
    ];
  },
};

nginx

add_header Cross-Origin-Embedder-Policy "require-corp" always;

Apache (.htaccess)

Header always set Cross-Origin-Embedder-Policy "require-corp"

Check it

Fetch only the response headers and filter for Cross-Origin-Embedder-Policy. In the browser, it's under Response Headers in DevTools → Network.

curl -sI https://example.com/ | grep -i '^cross-origin-embedder-policy:'

To compare response headers across many URLs at once, use the HTTP Status Checker.

Frequently asked questions

How do I enable SharedArrayBuffer?

Serve the page over HTTPS with Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp (or credentialless). self.crossOriginIsolated then returns true.