RFC-ARCHIVE web-send.org Origin Isolation & Privacy Spec Ledger (2010-2026)

web-send.org › Cross-Origin Policy Workbench

CORS and Storage Partitioning Workbench

Deterministic client-side simulator for evaluating cross-origin leakage across window.name, credentialed CORS, postMessage, CHIPS cookies, and #fragment capability URLs.

Origin Boundary & Channel Policy Simulator

Instant Verdict · Normative Header Generator
1. Browser Isolation Profile
2. Cross-Origin Channel
3. Threat Scenario
ISOLATED Tor Browser Spec
Active Partition Key (firstPartyDomain: publisher.example)
window.name Invariant Cleared on cross-origin navigation

1. Normative Response Header Isolation Reference

Browser isolation works best when user-agent storage partitioning is paired with explicit server-emitted isolation headers. Use the reference matrix below to select headers that prevent ambient cookie leakage, cross-origin opener retention, and clickjacking overlays.

Table 1. HTTP Isolation Headers & Cookie Attributes for Cross-Origin Hardening
Header / Attribute Recommended Value Isolation Boundary Enforced
Cross-Origin-Opener-Policy same-origin Severs window.opener and forces a BrowsingContextGroup swap (resetting window.name).
Cross-Origin-Embedder-Policy require-corp Requires explicit CORS or CORP opt-in for all subresources, enabling isolated high-resolution timers.
Cross-Origin-Resource-Policy same-origin Blocks unauthorized cross-origin embedding and speculative side-channel reads.
Set-Cookie (CHIPS) __Host-id=...; Secure; SameSite=None; Partitioned Binds third-party cookie visibility strictly to the top-level site partition key.
Referrer-Policy no-referrer or strict-origin-when-cross-origin Prevents path and query capability parameters from leaking in outbound HTTP Referer headers.

2. Opener & Subresource Boundary Map

COOP, COEP, and CHIPS Partitioned Isolation Boundaries Defense-in-Depth Layers: Transport, Document Group, and Storage Jar Layer 1: COOP Severs cross-origin popup window.opener handles and clears window.name residue. Layer 2: CORS + CORP Blocks ambient reads and requires explicit allow-origin match without wildcard '*'. Layer 3: FPI / CHIPS Keys cookies, IndexedDB, and caches to the top-level first-party site tuple.