5

Today I received an email from Google:

New requirements for SharedArrayBuffers on https://example.com/

Google systems have recently detected that SharedArrayBuffers (SABs) are used on https://example.com/, but COOP and/or COEP headers are not served.

For web compatibility reasons, Chrome is planning to require COOP/COEP for the use of SABs from Chrome 91 (2021-25-05) onwards. Please implement 'cross-origin-isolated' behaviour on your site.

I have been reading up about this, this afternoon, but am totally lost!

I make a lot of use on my site of things like:

  1. Adverts from Freestar.io
  2. Static content (JS, CSS and some images) hosted in an AWS bucket
  3. Content from Youtube and Vimeo in iframes
  4. Bootstrap CSS and JS and jQuery from various CDNs

I have checked the headers from the CDNs, and can see the cross-origin-resource-policy is set to cross-origin and so, if I set these headers on my site:

Cross-Origin-Embedder-Policy = require-corp

Cross-Origin-Opener-Policy = same-origin

Then the content from CDNs where content that is served whose headers contain the cross-origin-resource-policy: cross-origin header, can be displayed as long as I include the crossorigin option e.g. here:

<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/css/bootstrap.min.css" crossorigin>

However, I have looked at various other sites, and they do not have those headers. Those sites include the following:

  1. AWS
  2. Freestar.io Advert
  3. Youtube and Vimeo

My questions are:

  1. Does anyone know if it is possible to configure an AWS bucket so that the content served by the bucket includes the cross-origin-resource-policy header? I have searched but cannot find anything to explain how to do that.
  2. Will adverts and videos no longer be displayed once the Chrome change to require COOP/COEP for the use of SABs is implemented, and if so, is that just something I am stuck with and can do nothing about since I have no way to make the external sites include that header in the content they serve?
4532066
  • 2,042
  • 5
  • 21
  • 48
  • 2
    This page (https://web.dev/cross-origin-isolation-guide/) was updated yesterday to provide advice re. how to find the page on your site that's using / or linking to Javascript that contains `SharedArrayBuffer` code. On my site it turned out it was linked to some JS delivered via an advert. Therefore my question was an over reaction - all the stuff delivered via AWS, Vimeo and Youtube, and the CDNs wasn't what triggered the email from Google Search Console, it was just one bit of JS from one advert publisher, and I can't control that anyway. – 4532066 Mar 17 '21 at 21:13
  • Thanks for this. I had the same problem, and never heard about SharedArrayBuffer before. I'm pretty sure I don't use that anywhere on my site, but it's very possible it may be used in some 3rd party thing I don't control, such as advertisements or embed videos :) – Nuno Mar 18 '21 at 09:12

0 Answers0