#333 · Developer Tool

COOP COEP CORP Checker

Inspect COOP, COEP, and CORP response headers as a single security configuration. The checker validates header values, determines whether a document is eligible for cross-origin isolation, and calls out combinations that commonly break popups or unlabelled subresources. Duplicate fields and missing protection are reported with direct remediation notes. Paste raw headers from a server response; no network request is made.

Developer Input

Response headers
Ad space

How to use this developer tool

  1. Paste the response headers or load the included sample.
  2. Adjust any tool-specific option shown below the input.
  3. Select Check Header Set or press Ctrl/Cmd + Enter.
  4. Review the summary and findings, then copy or download the output.

What this developer tool does

Normalizes the three header names, rejects unknown values, and evaluates the COOP plus COEP pair required for self.crossOriginIsolated.

Normalizes the three header names, rejects unknown values, and evaluates the COOP plus COEP pair required for self.crossOriginIsolated.

Eligibility is not proof that every resource will load. Each cross-origin dependency must satisfy CORS or CORP under require-corp.

Example

Input

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-origin

Output

Isolation eligible: yes
COOP: same-origin
COEP: require-corp
CORP: same-origin

Use cases

  • Review a deployment before changing production response headers.
  • Compare application and reverse-proxy configuration.
  • Create a reproducible finding for a security review or pull request.
  • Teach the practical effect of COOP COEP CORP settings.

Tips for reliable output

  • Use the complete header value, including repeated fields.
  • Test the final response after CDN and proxy processing.
  • Keep a copy of the before and after output for review.
  • Do not treat a passing result as a penetration test.
  • Recheck after framework, server, or browser-policy updates.

Processing details

Header names are case-insensitive. If a field appears more than once, the checker reports the duplicate rather than guessing how an intermediary combines it.

Origin-Agent-Cluster, CSP, CORS responses, iframe sandboxing, and browser-specific rollout behavior are outside this three-header check.

Frequently asked questions

Why is crossOriginIsolated false with COOP same-origin?

The checker reports this directly from the supplied response headers and shows the relevant value in its output.

Does COEP require-corp require CORP on every asset?

Use the result together with the browser and server behavior you support; the page does not make remote requests.

What is the difference between CORP and CORS?

Review the generated finding before deployment, especially when proxies or CDNs can alter headers.

Can COOP same-origin-allow-popups enable SharedArrayBuffer?

The implemented rule follows current HTTP security-header practice and flags values it cannot recognize.

How do duplicate COEP response headers behave?

Retest with the exact production response because small header changes can affect the conclusion.

Checks and output

StageWhat is reported
ParseRecognized input fields and values
ValidateInvalid, missing, or conflicting settings
ExportText, CSV, and JSON when structured data is available

HTTP & Security Headers

Browse more tools for HTTP behavior, browser policies, cookies, CORS, CSP, and response-header security.

View HTTP & Security Headers