Cross-Origin-Embedder-Policy

Cross-Origin-Embedder-Policy: unsafe-none | require-corp

unsafe-none

这是默认值。允许文档获取跨源资源，而无需通过 CORS 协议或 Cross-Origin-Resource-Policy 头。

require-corp

文档只能从相同的源加载资源，或显式标记为可从另一个源加载的资源。 如果跨源资源支持 CORS，则 crossorigin 属性或 Cross-Origin-Resource-Policy 头必须使用它来加载资源，而不会被 COEP 阻止。

为了节省时间你可以只接受类似于 SharedArrayBuffer 或者 Performance.now() 对象，只要你的文档有一个值被设置为 require-corp 的 COEP 标头。

Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin

你还需要设置的另一个标头：Cross-Origin-Opener-Policy。

为了验证跨源隔离是否生效，你可以测试窗口和 worker 上下文中的 Window.crossOriginIsolated 或 WorkerGlobalScope.crossOriginIsolated 属性：

const myWorker = new Worker("worker.js");

if (crossOriginIsolated) {
  const buffer = new SharedArrayBuffer(16);
  myWorker.postMessage(buffer);
} else {
  const buffer = new ArrayBuffer(16);
  myWorker.postMessage(buffer);
}

If you enable COEP using require-corp and have a cross origin resource that needs to be loaded, it needs to support CORS and you need to explicitly mark the resource as loadable from another origin to avoid blockage from COEP. For example, you can use the crossorigin attribute for this image from a third-party site:

<img src="https://thirdparty.com/img.png" crossorigin />

• Cross-Origin-Opener-Policy