相关文章推荐
瘦瘦的海豚  ·  跨源资源共享（CORS） - HTTP | MDN·  3 周前    · 
痴情的香菜  ·  406 Not Acceptable - ...·  3 周前    · 
风流倜傥的脆皮肠  ·  EASEC-2020-003 - ...·  8 小时前    · 
强悍的鸡蛋面  ·  南京麒麟为何不温不火？|石杨路|城东|内环_ ...·  10 月前    · 
有腹肌的熊猫  ·  西安交通大学哲学系副教授丁晓军来第十七届中国 ...·  1 年前    · 
豪爽的生菜  ·  苹果手机和Windows之间互传文件 - ...·  1 年前    · 
无聊的甜瓜  ·  79 太清观-我只想安静地打游戏-漫画牛·  2 年前    · 
拉风的海龟  ·  合肥轨道交通7号线_百度百科·  2 年前    · 
Code  ›  Window: crossOriginIsolated property
origin
https://developer.mozilla.org/en-US/docs/Web/API/Window/crossOriginIsolated
善良的鞭炮
1 月前

The crossOriginIsolated read-only property of the Window interface returns a boolean value that indicates whether the document is cross-origin isolated.

A cross-origin isolated document only shares its browsing context group with same-origin documents in popups and navigations, and resources (both same-origin and cross-origin) that the document has opted into using via CORS (and COEP for <iframe> ). The relationship between a cross-origin opener of the document or any cross-origin popups that it opens are severed. The document may also be hosted in a separate OS process alongside other documents with which it can communicate by operating on shared memory. This mitigates the risk of side-channel attacks and cross-origin attacks referred to as XS-Leaks .

Cross-origin isolated documents operate with fewer restrictions when using the following APIs:

  • SharedArrayBuffer can be created and sent via a Window.postMessage() or a MessagePort.postMessage() call.
  • Performance.now() offers better precision.
  • Performance.measureUserAgentSpecificMemory() can be called.

    • A document will be cross-origin isolated if it is returned with an HTTP response that includes the headers:

  • Cross-Origin-Opener-Policy header with the directive same-origin .
  • Cross-Origin-Embedder-Policy header with the directive require-corp or credentialless .

    • Access to the APIs must also be allowed by the Permissions-Policy cross-origin-isolated . Otherwise crossOriginIsolated property will return false , and the document will not be able to use the APIs listed above with reduced restrictions.

    Set the Cross-Origin-Embedder-Policy HTTP header to require-corp or credentialless :

    http 
    Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Embedder-Policy: credentialless

    The cross-origin-isolated directive of the Permissions-Policy header must not block access to the feature.
Note that the default allowlist of the directive is self, so the permission will be granted by default to cross-origin isolated documents.
    
    
    Checking if the document is cross-origin isolated
    
    
    js
    const myWorker = new Worker("worker.js");
if (window.crossOriginIsolated) {
  const buffer = new SharedArrayBuffer(16);
  myWorker.postMessage(buffer);
} else {
  const buffer = new ArrayBuffer(16);
  myWorker.postMessage(buffer);
    
    Specifications
    
        Specification
          Learn how to contribute 
    
    This page was last modified on  by MDN contributors.
    View this page on GitHub • Report a problem with this content
      
    1. Document Object Model (DOM)
    2. Window
    3. Instance properties
      1. caches
      2. closed
      3. cookieStore
      4. credentialless


      5. crossOriginIsolated
      6. crypto
      7. customElements
      8. devicePixelRatio
      9. document
      10. documentPictureInPicture


      11. event


      12. external


      13. fence


      14. frameElement
      15. frames
      16. fullScreen


      17. history
      18. indexedDB
      19. innerHeight
      20. innerWidth
      21. isSecureContext
      22. launchQueue


      23. length
      24. localStorage
      25. location
      26. locationbar
      27. menubar
      28. mozInnerScreenX


      29. mozInnerScreenY


      30. name
      31. navigation


      32. navigator
      33. opener
      34. orientation


      35. origin
      36. originAgentCluster
      37. outerHeight
      38. outerWidth
      39. parent
      40. performance
      41. personalbar
      42. scheduler
      43. screen
      44. screenLeft
      45. screenTop
      46. screenX
      47. screenY
      48. scrollbars
      49. scrollMaxX


      50. scrollMaxY


      51. scrollX
      52. scrollY
      53. self
      54. sessionStorage
      55. sharedStorage


      56. speechSynthesis
      57. status


      58. statusbar
      59. toolbar
      60. top
      61. trustedTypes
      62. visualViewport
      63. window
    4. Instance methods
      1. alert()
      2. atob()
      3. blur()


      4. btoa()
      5. cancelAnimationFrame()
      6. cancelIdleCallback()
      7. captureEvents()


      8. clearImmediate()



      9. clearInterval()
      10. clearTimeout()
      11. close()
      12. confirm()
      13. createImageBitmap()
      14. dump()


      15. fetch()
      16. fetchLater()


      17. find()


      18. focus()
      19. getComputedStyle()
      20. getDefaultComputedStyle()


      21. getScreenDetails()


      22. getSelection()
      23. matchMedia()
      24. moveBy()
      25. moveTo()
      26. open()
      27. postMessage()
      28. print()
      29. prompt()
      30. queryLocalFonts()


      31. queueMicrotask()
      32. releaseEvents()


      33. reportError()
      34. requestAnimationFrame()
      35. requestFileSystem()



      36. requestIdleCallback()
      37. resizeBy()
      38. resizeTo()
      39. scroll()
      40. scrollBy()
      41. scrollByLines()


      42. scrollByPages()


      43. scrollTo()
      44. setImmediate()



      45. setInterval()
      46. setResizable()



      47. setTimeout()
      48. showDirectoryPicker()


      49. showOpenFilePicker()


      50. showSaveFilePicker()


      51. sizeToContent()


      52. stop()
      53. structuredClone()
      54. webkitConvertPointFromNodeToPage()



      55. webkitConvertPointFromPageToNode()



    5. Events
      1. afterprint
      2. appinstalled
      3. beforeinstallprompt
      4. beforeprint
      5. beforeunload
      6. blur
      7. devicemotion
      8. deviceorientation
      9. deviceorientationabsolute
      10. error
      11. focus
      12. gamepadconnected
      13. gamepaddisconnected
      14. hashchange
      15. languagechange
      16. load
      17. message
      18. messageerror
      19. offline
      20. online
      21. orientationchange


      22. pagehide
      23. pagereveal
      24. pageshow
      25. pageswap
      26. popstate
      27. rejectionhandled
      28. resize
      29. scrollsnapchange


      30. scrollsnapchanging


      31. storage
      32. unhandledrejection
      33. unload


      34. vrdisplayactivate



      35. vrdisplayconnect



      36. vrdisplaydeactivate



      37. vrdisplaydisconnect



      38. vrdisplaypresentchange



    6. Inheritance
      1. EventTarget
    7. Related pages for DOM
      1. AbortController
      2. AbortSignal
      3. AbstractRange
      4. Attr
      5. CDATASection
      6. CharacterData
      7. Comment
      8. CustomEvent
      9. DOMError


      10. DOMException
      11. DOMImplementation
      12. DOMParser
      13. DOMPoint
      14. DOMPointReadOnly
      15. DOMRect
      16. DOMTokenList
      17. Document
      18. DocumentFragment
      19. DocumentType
      20. Element
      21. Event
      22. EventTarget
      23. HTMLCollection
      24. MutationObserver
      25. MutationRecord
      26. NamedNodeMap
      27. Node
      28. NodeIterator
      29. NodeList
      30. ProcessingInstruction
      31. QuotaExceededError


      32. Range
      33. StaticRange
      34. Text
      35. TextDecoder
      36. TextEncoder
      37. TimeRanges
      38. TreeWalker
      39. XMLDocument
    8. Guides
      1. Introduction to the DOM
      2. Using the Document Object Model
      3. Attribute reflection
      4. Traversing an HTML table with JavaScript and DOM Interfaces
      5. Locating DOM elements using selectors
      6. Working with events
      7. Examples of web and XML development using the DOM
     
    推荐文章
    瘦瘦的海豚  ·  跨源资源共享（CORS） - HTTP | MDN
    3 周前
    痴情的香菜  ·  406 Not Acceptable - HTTP | MDN
    3 周前
    风流倜傥的脆皮肠  ·  EASEC-2020-003 - Origin 客户端中的跨站脚本攻击漏洞
    8 小时前
    强悍的鸡蛋面  ·  南京麒麟为何不温不火？|石杨路|城东|内环_网易订阅
    10 月前
    有腹肌的熊猫  ·  西安交通大学哲学系副教授丁晓军来第十七届中国心理学家大会啦！_研究_逻辑_精神
    1 年前
    豪爽的生菜  ·  苹果手机和Windows之间互传文件 - zhengcixi - 博客园
    1 年前
    无聊的甜瓜  ·  79 太清观-我只想安静地打游戏-漫画牛
    2 年前
    拉风的海龟  ·  合肥轨道交通7号线_百度百科
    2 年前
    今天看啥   ·   Py中国   ·   codingpro   ·   小百科   ·   link之家   ·   卧龙AI搜索
    删除内容请联系邮箱 2879853325@qq.com
    Code - 代码工具平台
    © 2024 ~ 沪ICP备11025650号