Filing this to track implementation now that WebKit's standards position is down to a single venue concern. Claude helped me pull this together: > Document-Isolation-Policy (DIP) is an HTTP response header that lets a single document opt into cross-origin isolation on its own, without needing its embedder or its embedded content to cooperate. It relies on process isolation for the isolation guarantee instead of the COOP + COEP header pair. > > Spec: https://wicg.github.io/document-isolation-policy/ > Explainer: https://github.com/WICG/document-isolation-policy > Tests: https://github.com/web-platform-tests/wpt/tree/master/html/document-isolation-policy (currently .tentative) > Results: https://wpt.fyi/results/html/document-isolation-policy > > Status: > > - WebKit position: https://github.com/WebKit/standards-positions/issues/399 - the latest comment says the portability concerns have been addressed and the remaining concern is venue: https://github.com/WebKit/standards-positions/issues/399#issuecomment-5844114111 > - Upstreaming to HTML and Fetch is tracked in https://github.com/WICG/document-isolation-policy/issues/8 > - Mozilla position is positive: https://github.com/mozilla/standards-positions/issues/1074 (Gecko bug: https://bugzilla.mozilla.org/show_bug.cgi?id=2063367) > - Chrome shipped DIP on desktop in 137 and on Android in 146: https://chromestatus.com/feature/5141940204208128 > > Steps to reproduce: > > 1. Serve a document with the response header `Document-Isolation-Policy: isolate-and-credentialless` (or `isolate-and-require-corp`). > 2. Embed that document in a cross-origin iframe on a page that sends no isolation headers of its own. > 3. In the embedded document, check `self.crossOriginIsolated` and try to construct a `SharedArrayBuffer`. > > Actual: Safari ignores the header. `self.crossOriginIsolated` is `false` and `SharedArrayBuffer` is unavailable. > > Expected: the document becomes cross-origin isolated on its own, and the embedding page is unaffected - it keeps its cross-origin popups and unrestricted third-party embeds. > > Why this matters in practice: > > - WordPress 7.1 uses wasm-vips (and so `SharedArrayBuffer`) to process image uploads in the browser, and sends DIP on block editor screens. The editor renders in an iframe, and the feature started on COOP/COEP, hit the frame-chain problem, and moved to DIP: https://github.com/WordPress/gutenberg/pull/75991 . WordPress only enables this for Chromium 137+, so Safari users fall back to server-side processing. > - WordPress Playground rewrites COOP/COEP headers into DIP to make isolation work: https://github.com/WordPress/wordpress-playground/pull/3028 > - Zoom describes the same problem for embedded SDKs: https://github.com/WebKit/standards-positions/issues/399#issuecomment-4173351100 Happy to help with testing or anything else that's useful here.