#332 · Developer Tool

Cross Origin Policy Header Builder

Build a coordinated set of cross-origin isolation headers from a short deployment scenario. Choose how the top-level document should interact with popups, whether embedded resources must opt in, and which origins may load a resource. The output includes COOP, COEP, and CORP lines with a short compatibility warning where credentialless behavior is selected. It is intended for configuration drafting, not automatic server reconfiguration.

Developer Input

Resource scenario
Ad space

How to use this developer tool

  1. Paste the resource scenario or load the included sample.
  2. Adjust any tool-specific option shown below the input.
  3. Select Build Headers or press Ctrl/Cmd + Enter.
  4. Review the summary and findings, then copy or download the output.

What this developer tool does

Maps the requested isolation, embedder, resource, and credential settings to valid COOP, COEP, and CORP header values.

Maps the requested isolation, embedder, resource, and credential settings to valid COOP, COEP, and CORP header values.

Apply COOP and COEP to documents. CORP normally belongs on the resources those documents fetch.

Example

Input

resource=app
isolation=yes
embedders=same-site
credentials=no

Output

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-site

Use cases

  • Review a deployment before changing production response headers.
  • Compare application and reverse-proxy configuration.
  • Create a reproducible finding for a security review or pull request.
  • Teach the practical effect of Cross Origin Policy Header settings.

Tips for reliable output

  • Use the complete header value, including repeated fields.
  • Test the final response after CDN and proxy processing.
  • Keep a copy of the before and after output for review.
  • Do not treat a passing result as a penetration test.
  • Recheck after framework, server, or browser-policy updates.

Processing details

Input uses key=value lines. Supported keys are resource, isolation, embedders, credentials, coop, coep, and corp.

The builder cannot inspect third-party resources. Test fonts, scripts, images, workers, and popups after deploying the headers.

Frequently asked questions

Which headers are required for cross-origin isolation?

The checker reports this directly from the supplied resource scenario and shows the relevant value in its output.

Should CORP be set on the document or each resource?

Use the result together with the browser and server behavior you support; the page does not make remote requests.

When should I use COEP credentialless instead of require-corp?

Review the generated finding before deployment, especially when proxies or CDNs can alter headers.

Will COOP same-origin break OAuth popup flows?

The implemented rule follows current HTTP security-header practice and flags values it cannot recognize.

Can same-site CORP resources load from a subdomain?

Retest with the exact production response because small header changes can affect the conclusion.

Checks and output

StageWhat is reported
ParseRecognized input fields and values
ValidateInvalid, missing, or conflicting settings
ExportText, CSV, and JSON when structured data is available

HTTP & Security Headers

Browse more tools for HTTP behavior, browser policies, cookies, CORS, CSP, and response-header security.

View HTTP & Security Headers