Load cross-origin resources without CORP headers using COEP: credentialless | Blog | Chrome for Developers

We have shipped the new Cross-Origin Embedder Policy (COEP) value credentialless which allows the browser to load cross-origin resources which don't use the Cross-Origin Resource Policy (CORP), by sending a request without credentials, such as cookies. This helps developers to adopt cross-origin isolation more easily. Why we need cross-origin isolation Some web APIs increase the risk of side-chann

[efcl]

`Cross-Origin-Embedder-Policy: credentialless`について。 クロスオリジン分離のためにCross Originのresponse headerを全て制御するのが現実的ではないため、リクエスト側でcredentialを送らないことを宣言して分離する