Fix: CORP does not enable SharedArrayBuffer
- Dominant language
- Markdown
- Stars
- 11k
- Forks
- 23.2k
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 331
Description
### MDN URL
https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/CORP
### What specific section or headline is this issue about?
Examples
### What information was incorrect, unhelpful, or incomplete?
I believe SharedArrayBuffer is enabled by COOP + COEP, not CORP and CORP only affects resources, not the enabling of SharedArrayBuffer itself.
**Affected text:**
Instruct browsers to allow cross-origin resource access, including access to features with unthrottled timers (such as [SharedArrayBuffer](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer) objects or [Performance.now()](https://developer.mozilla.org/en-US/docs/Web/API/Performance/now)):
```http
Cross-Origin-Resource-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
```
This also permits such resources to be embedded.
### What did you expect to see?
To enable SharedArrayBuffer and performance.now(), the document must be cross-origin isolated environment. Include the following headers on the document:
```http
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
```
A page using `Cross-Origin-Embedder-Policy`: `require-corp` may only load resources that explicitly allow being embedded.
Resources can opt in using either:
**Cross-Origin-Resource-Policy (CORP):**
```http
Cross-Origin-Resource-Policy: cross-origin
```
**or CORS:**
```http
Access-Control-Allow-Origin: https://example.com
```
CORP and CORS do not themselves enable SharedArrayBuffer they only allow resources to be loaded under COEP so that isolation is maintained.
### Do you have any supporting links, references, or citations?
_No response_
### Do you have anything more you want to share?
Please suggest if there any improvements are needed to the proposed text, if everything looks good, I would be happy to open a pull to update the documentation.
Contributor guide
Assessment
This issue has not been assessed yet.