COOP / COEP Headers Builder

You tried to use SharedArrayBuffer, run ffmpeg.wasm with threads or call performance.measureUserAgentSpecificMemory, and the console told you the page is not isolated. The fix is to send two headers together, COOP and COEP, and the usual confusion is which pair of values actually flips crossOriginIsolated to true. This page builds both lines so you can paste them into your server config.

Both fields are free text with no validation at all: whatever you type goes into the line as is, and an empty field falls back to same-origin and require-corp. What matters is what each one does. COOP same-origin severs the link to windows from other origins, so window.opener becomes null. COEP require-corp demands that every cross origin resource arrive with Cross-Origin-Resource-Policy or CORS, while credentialless is the middle ground that fetches without credentials instead of requiring the header.

Once deployed, open the console and evaluate self.crossOriginIsolated. If it returns false, the culprit is almost always a CDN asset with no CORP, and the Network tab will show which request was blocked. Think twice before enabling this if your login flow uses an OAuth popup that talks back to the opener, or if you embed older third party widgets without CORP, because the breakage tends to be quiet in production. The tool writes two lines in your browser and never inspects your assets.