Security Vulnerabilities Guide

Understanding and fixing common web security vulnerabilities detected by VitaPulse

Low
No Cross-Origin Isolation

Your site is not cross-origin isolated, meaning it cannot use powerful performance APIs and is more vulnerable to side-channel attacks.

Risk

Without cross-origin isolation (COOP + COEP), your site cannot use SharedArrayBuffer, high-resolution timers, or performance.measureUserAgentSpecificMemory(). More critically, your process memory is vulnerable to Spectre-class attacks from cross-origin content loaded in the same process.

Solution

Set both Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp headers. Ensure all cross-origin resources have appropriate CORS or CORP headers.

Example
Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp
Cross-Origin Isolation - web.dev
Comments (0)

No messages yet.