3

on a website I have to embed an iframe that requires the following headers on my website, since it needs the SharedArrayBuffer feature:

Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin

Unfortunately, a 3rd party service IFRAME I still need in my page is not loading anymore. There's a way to allow a 3rd party domain even with the embedded-policy turned on?

Thanks. Dario.

sideshowbarker
  • 81,827
  • 26
  • 193
  • 197
skini82
  • 396
  • 4
  • 17
  • did you get an answer to this? does the accepted answer work for you? seems like COOP/COEP shouldn't have anything to do with frame ancestors, but does that solve the problem? – gaurav5430 Dec 19 '21 at 17:43

3 Answers3

3

If the document loaded into iframe is cross-origin, it needs to send the following two headers:

Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: cross-origin

If it's difficult, please register for an origin trial to temporarily exempt the requirement from your domain. This will let your website use SharedArrayBuffer without COOP/COEP headers at least on Chrome.

In the meantime, the standard body is working to introduce an option to load iframe without requiring those headers. Learn more at:

https://github.com/camillelamy/explainers/blob/master/anonymous_iframes.md

agektmr
  • 2,144
  • 15
  • 14
2

The 3rd party website will have to add your domain in the content security policy response header:

Response header from 3rd party website:

"Content-Security-Policy: frame-ancestors 'self' https://*.yourdomain.com;";

If you don't have control over it, there is nothing you can do.

Yusufali2205
  • 1,222
  • 9
  • 17
  • Thanks! I cannot verify this since I don't have control on 3rd party service, but it goes on what I was thinking! – skini82 Aug 09 '21 at 18:31
-1

You need control over the domain you want to embed to remove/amend its CORS policy. It the domain has explicitely blocked Cross-Origin requests, there's nothing you can do about it.

This is used to avoid anyone hijacking any site you want (you could have a full screen Google in an iframe running with your ads on top on bettergoogle.com, things like that). This will help out read this one

Rajan Raj Shah
  • 11
  • 1