http permissions policy directive
Permissions-Policy: cross-origin-isolated directive
Limited availability
The HTTP Permissions-Policy header cross-origin-isolated directive controls whether the current document is allowed to use APIs that require cross-origin isolation.
Specifically, where a defined policy blocks use of this feature, the crossOriginIsolated and crossOriginIsolated properties will always return false, and the document will not benefit from reduced restrictions on the use of some APIs that are granted only to cross-origin isolated documents.
This is true regardless of the Cross-Origin-Embedder-Policy and Cross-Origin-Opener-Policy headers, and whether the document would have been cross-origin isolated had the permission been granted.
The APIs that require this permission include the use of SharedArrayBuffer objects and now() with unthrottled timers — see crossOriginIsolated for information about other restricted APIs.
The permission can be used to maintain restrictions on access to the sensitive APIs unless they are actually needed by a cross-origin isolated document. Note that if the feature is not allowed, but it otherwise would have been cross-origin isolated, then in all other respects it is still cross-origin isolated. For example, it will only share a browsing context group with documents in the same origin.
Syntax
Permissions-Policy: cross-origin-isolated=<allowlist>;
<allowlist>- : A list of one or more origins for which permission is granted to use the feature.
See
Permissions-Policy> Syntax for more details.
- : A list of one or more origins for which permission is granted to use the feature.
See
Default policy
The default allowlist for cross-origin-isolated is self.