Cross-Origin-Embedder-Policy

Cross-Origin-Embedder-Policy
Name	Cross-Origin-Embedder-Policy
Status	W3C / WHATWG discussion
Introduced	2019
Related	Same-Origin Policy; Content-Security-Policy; Cross-Origin-Opener-Policy
Purpose	control embedding and resource isolation

Cross-Origin-Embedder-Policy Cross-Origin-Embedder-Policy is an HTTP header and web platform mechanism that mandates how a browsing context may load and embed cross-origin resources, enabling isolated execution environments for advanced capabilities. The policy integrates with standards from World Wide Web Consortium and WHATWG, interacts with headers used by Mozilla Foundation, Google LLC, Microsoft Corporation, and Apple Inc., and is relevant to authors deploying content on servers such as Apache HTTP Server and Nginx.

Overview

Cross-Origin-Embedder-Policy defines a declarative signal sent by servers to enforce restrictions on cross-origin embedding and resource loading, complementing the Same-Origin Policy and Cross-Origin Resource Sharing. It arose in discussions involving W3C, IETF, and browser vendors including Google Chrome and Mozilla Firefox to support features proposed in WebAssembly and SharedArrayBuffer proposals. Implementation decisions have involved contributors from Chromium Project and stakeholders such as Cloudflare and Akamai Technologies.

Policy Values and Semantics

The policy exposes values negotiated by servers and browsing contexts, typically conveyed via an HTTP header. Common values were designed in collaboration among engineers from Google LLC and Mozilla Foundation and influence behavior in engines like Blink (browser engine) and Gecko (Mozilla). The semantics determine whether the document is allowed to embed cross-origin resources, require opt-in from resource origins, and interact with Cross-Origin-Opener-Policy to create isolated top-level browsing contexts. Authors must consider interactions with legacy headers deployed by platforms such as Microsoft IIS and Amazon Web Services.

Security Benefits and Use Cases

Adopting the policy enables mitigations that benefit features historically discussed at events like Black Hat USA and Defcon and researched by teams at Google Project Zero and Mozilla Security. Use cases include enabling secure usage of SharedArrayBuffer for high-performance applications proposed in WebAssembly and reducing attack surfaces exploited in incidents reported by CERT Coordination Center and US-CERT. The mechanism helps harden sites in sectors such as finance (banks like JPMorgan Chase) and services run by companies including Netflix and Spotify that leverage high-fidelity media processing, as well as research prototypes from institutions like MIT and Stanford University.

Implementation and Browser Support

Browser vendors implemented support in stages, with initial shipping in Google Chrome and subsequent work by Mozilla Foundation and Microsoft Corporation for Edge (web browser). Engine-level work took place in Blink (browser engine) and Gecko (Mozilla), with testing coordinated through projects hosted by W3C and repository platforms like GitHub. Server-side adopters adapted configurations for Apache HTTP Server, Nginx, and cloud delivery via Cloudflare. Support matrices discussed at conferences such as IETF meetings and in bug trackers like those of Chromium Project document rollout timelines and interoperability notes.

Interaction with Other Web Platform Features

The policy is designed to interoperate with Content-Security-Policy, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy to form layered defenses. It affects advanced APIs such as WebAssembly, SharedArrayBuffer, Web Workers, and features used by web applications built with frameworks or platforms like React (JavaScript library), Angular (web framework), and Node.js. The interaction surface was the subject of collaboration between teams at Google LLC, Mozilla Foundation, and academic groups from University of California, Berkeley and ETH Zurich to ensure predictable semantics across implementations.

Deployment and Compatibility Considerations

Deployers must weigh compatibility with third-party content from providers such as YouTube, Twitter, and Facebook when sending restrictive headers, and consider coordination with content delivery networks including Akamai Technologies and Fastly. Progressive deployment patterns referenced by engineers from Google LLC and Mozilla Foundation include feature detection, reporting mechanisms, and staged rollout strategies used by organizations like GitHub and Mozilla Corporation. Debugging and diagnostic workflows often involve browser developer tools created by teams at Google LLC and Mozilla Foundation and incident tracking informed by advisories from agencies such as NIST.

Category:Web security standards