Safety
Origin-Agent-Cluster vs COOP for Process Isolation
December 17, 2024
Origin-Agent-Cluster vs COOP for process isolation is two complementary browser isolation knobs, not substitutes. Origin-Agent-Cluster: ?1 asks supporting browsers to put this origin in its own agent cluster — a process-isolation hint so document.domain and some same-site-but-cross-origin sharing stay off. Cross-Origin-Opener-Policy (same-origin or same-origin-allow-popups) splits browsing context groups so window.opener from a cross-origin popup cannot reach you. COEP is about loading cross-origin subresources with CORP/CORS. Marketing sites that never pop windows still want framing controls (CSP frame-ancestors). RoastMyOpsec does not score Origin-Agent-Cluster, COOP, or COEP. Missing them is not an F on a brochure origin. It does grade CSP framing on the landing response.
The practical difference
OAC is 'this origin prefers not to share a process with sibling origins on the same site.' COOP is 'this window should not share a browsing context group with its opener.' You can set OAC without COOP. Cross-origin isolation (SharedArrayBuffer, precise timers) still needs COOP+COEP together.
document.domain relaxation fights OAC. If you still use document.domain, do not expect origin-keyed clusters.
How to choose what to ship
App origins that handle sessions: COOP same-origin or same-origin-allow-popups if you need OAuth popups; OAC ?1 if you do not rely on document.domain. Static marketing: framing + cookies first; OAC is cheap and optional. Do not set COEP require-corp until every embed is CORS or CORP-ready.
| Header | What it isolates | Breaks if | Takeaway |
|---|---|---|---|
| Origin-Agent-Cluster: ?1 | Agent cluster / process hint | You still set document.domain | Cheap on modern browsers |
| COOP same-origin | Opener / context group | You need cross-origin window.opener | See COOP vs COEP |
| COEP | Who may be loaded as a CORP resource | Third-party embeds without CORS/CORP | Not a brochure default |
| CSP frame-ancestors | Who may iframe you | You omit it and rely on OAC | Still required for clickjacking |
What the roast can prove
Framing headers on the HTML response can surface. Absence of OAC or COOP is not scored. Confirm popups and embeds in the app. Pair with CORP vs CORS if you later chase cross-origin isolation.
Common mistakes
The first mistake is COOP same-origin and a login popup that needs opener.
The second mistake is OAC while still assigning document.domain.
The third mistake is treating OAC as a replacement for CSP framing.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does Origin-Agent-Cluster replace COOP?
- No. OAC is origin-keyed clusters. COOP is opener and context groups. Cross-origin isolation still needs COOP+COEP.
- Should brochure sites set Origin-Agent-Cluster?
- It is a reasonable default on modern stacks. Missing it is not a roast F.
- Does RoastMyOpsec score Origin-Agent-Cluster?
- No. It does not score COOP or COEP either. Framing CSP is the header pack that is graded.