https://docs.google.com/document/d/1zDlfvfTJ_9e8Jdc8ehuV4zMEu9ySMCiTGMS9y0GU92k/edit has an explainer that's quite detailed. You need to use HTTPS. Top-level documents need these headers: ``` Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp ``` Nested documents and workers only need the second header of those. Nested documents and subresources might need `Cross-Origin-Resource-Policy: cross-site` (or `same-site`) if they are cross-origin (or cross-origin-but-same-site).
Bug 1586217 Comment 9 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
https://docs.google.com/document/d/1zDlfvfTJ_9e8Jdc8ehuV4zMEu9ySMCiTGMS9y0GU92k/edit has an explainer that's quite detailed. You need to use HTTPS. Top-level documents need these headers: ``` Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp ``` Nested documents and workers only need the second header of those. Nested documents and subresources might need `Cross-Origin-Resource-Policy: cross-site` (or `same-site`) if they are cross-origin (or cross-origin-but-same-site). Also, to play with this in Firefox Nightly you need to set these flags: * dom.postMessage.sharedArrayBuffer.withCOOP_COEP * javascript.options.shared_memory * browser.tabs.remote.useCrossOriginOpenerPolicy * browser.tabs.remote.useCrossOriginEmbedderPolicy
https://docs.google.com/document/d/1zDlfvfTJ_9e8Jdc8ehuV4zMEu9ySMCiTGMS9y0GU92k/edit has an explainer that's quite detailed. You need to use HTTPS. Top-level documents need these headers: ``` Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp ``` Nested documents and workers only need the second header of those. Nested documents and subresources might need `Cross-Origin-Resource-Policy: cross-site` (or `same-site`) if they are cross-origin (or cross-origin-but-same-site). Also, to play with this in Firefox Nightly you need to set these flags: * dom.postMessage.sharedArrayBuffer.withCOOP_COEP * javascript.options.shared_memory * browser.tabs.remote.useCrossOriginOpenerPolicy * browser.tabs.remote.useCrossOriginEmbedderPolicy (I filed https://github.com/mdn/sprints/issues/2219 on getting this all on MDN.)