mdn / mdn/content

Fix: CORP does not enable SharedArrayBuffer

Open
#42,236 1 comment 0 reactions 0 assignees View on GitHub
Content:Security
Dominant language
Markdown
Stars
11k
Forks
23.2k
Avg merge
2d 9h
Merged PRs (30d)
331

Description

### MDN URL

https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/CORP

### What specific section or headline is this issue about?

Examples

### What information was incorrect, unhelpful, or incomplete?

I believe SharedArrayBuffer is enabled by COOP + COEP, not CORP and CORP only affects resources, not the enabling of SharedArrayBuffer itself.

**Affected text:**

Instruct browsers to allow cross-origin resource access, including access to features with unthrottled timers (such as [SharedArrayBuffer](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer) objects or [Performance.now()](https://developer.mozilla.org/en-US/docs/Web/API/Performance/now)):

```http
Cross-Origin-Resource-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
```
This also permits such resources to be embedded.

### What did you expect to see?

To enable SharedArrayBuffer and performance.now(), the document must be cross-origin isolated environment. Include the following headers on the document:

```http
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
```

A page using `Cross-Origin-Embedder-Policy`: `require-corp` may only load resources that explicitly allow being embedded.
Resources can opt in using either:

**Cross-Origin-Resource-Policy (CORP):**
```http
Cross-Origin-Resource-Policy: cross-origin
```
**or CORS:**

```http
Access-Control-Allow-Origin: https://example.com
```

CORP and CORS do not themselves enable SharedArrayBuffer they only allow resources to be loaded under COEP so that isolation is maintained.

### Do you have any supporting links, references, or citations?

_No response_

### Do you have anything more you want to share?

Please suggest if there any improvements are needed to the proposed text, if everything looks good, I would be happy to open a pull to update the documentation.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.