wtf( )unctionsystem design, drawn
← all problemsBrowser SecurityHard

Isolation you cannot deploy alone

The page needs shared memory, which the browser only hands to a document that has proved it is cross-origin isolated. The two headers went on, and three of the things the page loads stopped loading.

The embedder policy is not a statement about your own resources. It is a demand you place on everything you embed — and one of the three is an iframe from a vendor who will never set a header for you.

Get the page isolated. One of the three things it loads has no fix you can apply from here.
Components — tap one, then tap a slot on the diagram
?Cross-origin isolation makes every third party a blocker. One uncooperative embed and the capability is gone.

Boundaries, outermost first: Not yours to fix: Vendor's iframe (sets no headers at all; FAILED: you cannot fix it), Vendor script host (fetched in no-cors mode; FAILED: no CORP header) Outside every boundary: Your asset host (a subdomain you own), Your document (needs shared memory), Embedder policy (require-corp, deployed), an empty slot for the the opener policy value, an empty slot for the what a host you own sends, an empty slot for the how this one is asked for Connections: the opener policy value controls Your document — condition one (step 1) Embedder policy controls Your document — condition two (step 2) Your document calls what a host you own sends (step 3) what a host you own sends calls Your asset host — declares a policy Your document calls how this one is asked for (step 4) how this one is asked for calls Vendor script host — cors, not no-cors Your document must NOT reach Vendor's iframe — no lever on this one

Vendor's iframesets no headers at allyou cannot fix it
Your asset hosta subdomain you own
Vendor script hostfetched in no-cors modeno CORP header
Your documentneeds shared memory
Embedder policyrequire-corp, deployed