Leitfaden für Sicherheitslücken

Häufige Web-Sicherheitslücken verstehen und beheben, die von VitaPulse erkannt werden

Niedrig
No Cross-Origin Isolation

Your site is not cross-origin isolated, meaning it cannot use powerful performance APIs and is more vulnerable to side-channel attacks.

Risiko

Without cross-origin isolation (COOP + COEP), your site cannot use SharedArrayBuffer, high-resolution timers, or performance.measureUserAgentSpecificMemory(). More critically, your process memory is vulnerable to Spectre-class attacks from cross-origin content loaded in the same process.

Lösung

Set both Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp headers. Ensure all cross-origin resources have appropriate CORS or CORP headers.

Beispiel
Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp
Cross-Origin Isolation - web.dev
Kommentare (0)

Noch keine Kommentare. Beginnen Sie die Diskussion!