![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
#64766 closed defect (bug) (fixed)
Media: Use Document-Isolation-Policy for cross-origin isolation on Chromium 137+.
| Reported by: | adamsilverstein | Owned by: | adamsilverstein |
|---|---|---|---|
| Priority: | normal | Milestone: | 7.0 |
| Component: | Editor | Version: | 7.0 |
| Severity: | normal | Keywords: | has-patch has-unit-tests |
| Cc: | Focuses: |
Description (last modified by )
Replace COEP/COOP headers with the new Document-Isolation-Policy header on Chromium 137+ for cross-origin isolation. DIP provides per-document isolation without breaking third-party page builder iframes (e.g. Elementor). Non-DIP browsers skip cross-origin isolation entirely, since COEP/COOP caused CORS failures for embeds.
- Add
wp_get_chrome_major_version()helper to detect Chromium browser version. - Add
wp_use_document_isolation_policyfilter for customization. - Set
window.__documentIsolationPolicyJS flag when DIP is active. - Skip cross-origin isolation when a third-party editor action is detected.
- Send
Document-Isolation-Policy: isolate-and-credentiallessheader instead of COEP/COOP. - Skip the output buffer entirely on non-DIP browsers to prevent CORS failures.
Change History (19)
This ticket was mentioned in PR #11098 on WordPress/wordpress-develop by @adamsilverstein.
4 months ago
#1
#2
follow-up:
↓ 7
@
4 months ago
This looks like an enhancement and not a bugfix.
I'll defer on 7.0 tech leads @ellatrix @mukesh27 and @SergeyBiryukov for the decision on whether we include it or not in 7.0, but in my opinion, it's a bit late in the release cycle to implement new hooks or functions.
@adamsilverstein commented on PR #11098:
4 months ago
#3
I started working on a plugin to re-enable the COEP/COOP approach here: https://github.com/adamsilverstein/client-side-media-experiments/
@adamsilverstein commented on PR #11098:
4 months ago
#4
I started working on a plugin to re-enable the COEP/COOP approach here: https://github.com/adamsilverstein/client-side-media-experiments/
#5
@
4 months ago
Related to https://core.trac.wordpress.org/ticket/64740 (responding to @audrasjb)
#6
@
4 months ago
Tested on trunk with Chrome 145 (PHP 8.2).
Document-Isolation-Policy: isolate-and-credentialless header is correctly sent and Cross-Origin-Embedder-Policy / Cross-Origin-Opener-Policy are no longer present.
window.documentIsolationPolicy is set to true.
No CORS or console errors observed. Editor and media features working as expected.
Before Patch :
https://postimg.cc/ft3snN2w
After Patch :
https://postimg.cc/WtgRMSQs
#7
in reply to: ↑ 2
@
4 months ago
Replying to audrasjb:
This looks like an enhancement and not a bugfix.
I'll defer on 7.0 tech leads @ellatrix @mukesh27 and @SergeyBiryukov for the decision on whether we include it or not in 7.0, but in my opinion, it's a bit late in the release cycle to implement new hooks or functions.
We sometimes allow late changes like this to NEW features and...
I'm mainly trying to address some bugs reported for the new client side media feature. Especially Rich Text Boxes / TinyMCE in meta boxes/ACF.
The non-Gutenberg editor guard is a separate fix and I can break it out to a separate PR if desired.
That said, I trust the lead's decision and we can ship this in a 7.0.1 if needed. I am separately working on implementing this same change in Gutenberg.
@adamsilverstein commented on PR #11098:
4 months ago
#8
@swissspidy should we try to get this in before beta 3?
@westonruter commented on PR #11098:
4 months ago
#9
Per https://github.com/WordPress/gutenberg/pull/75991#issuecomment-3986895745:
- Chrome 137+: Full client-side media processing with DIP
@adamsilverstein Is this Chrome or Chromium? Will it work in Edge? Is there a Can I Use feature for this?
@swissspidy commented on PR #11098:
4 months ago
#10
Beta 3 would be good timing for sure. But yes need to check the Chromium question.
@adamsilverstein commented on PR #11098:
4 months ago
#11
Per WordPress/gutenberg#75991 (comment):
- Chrome 137+: Full client-side media processing with DIP
@adamsilverstein[[Image(chrome-extension://hgomfjikakokcbkjlfgodhklifiplmpg/images/wp-logo.png)]] Is this Chrome or Chromium? Will it work in Edge? Is there a Can I Use feature for this?
Chromestatus: https://chromestatus.com/feature/5141940204208128
Here is what Claude summarized:
DIP is a Chromium-level feature, so it works in Edge, Brave, Opera, and other Chromium browsers at version 137+. There isn't a Can I Use entry for it yet — the best reference is the Chrome Platform Status entry and the explainer on GitHub. The PR description should probably say "Chromium 137+" rather than "Chrome 137+" to be more accurate. (updating)
#12
@
4 months ago
- Description modified (diff)
- Summary Media: Use Document-Isolation-Policy for cross-origin isolation on Chrome 137+. → Media: Use Document-Isolation-Policy for cross-origin isolation on Chromium 137+.
@adamsilverstein commented on PR #11098:
4 months ago
#15
This ticket was mentioned in PR #11291 on WordPress/wordpress-develop by @adamsilverstein.
4 months ago
#17
- Keywords has-unit-tests added
## Trac ticket
https://core.trac.wordpress.org/ticket/64766
## Description
Removes IMG from the list of elements that receive crossorigin="anonymous" in wp_add_crossorigin_attributes(). Also removes the related imagesrcset handling from LINK elements.
Under Document-Isolation-Policy: isolate-and-credentialless (introduced in r61844), the browser's credentialless mode already handles cross-origin image loading without requiring CORS headers on the remote server. Explicitly adding crossorigin="anonymous" to <img> elements overrides this behavior and forces a CORS preflight — breaking images from servers that don't include Access-Control-Allow-Origin in their response headers.
This causes image previews to break in the block editor sidebar when an image block references an external URL (e.g. https://placehold.jp/1024x768.jpg).
Related Gutenberg issue: https://github.com/WordPress/gutenberg/issues/76476
Related Gutenberg PR: https://github.com/WordPress/gutenberg/pull/76618
## Changes
- Remove
IMGentry from$cross_origin_tag_attributesinwp_add_crossorigin_attributes() - Remove
imagesrcsetfromLINKentry (used for<link>preload tags for images — same issue) - Update existing test to use
<script>instead of<img>for the positive case - Add new test asserting
<img>does NOT getcrossorigin="anonymous"
## Testing
- Open block editor in Chromium 137+
- Add an Image block → "Insert from URL" →
https://placehold.jp/1024x768.jpg - Sidebar preview should render correctly (no CORS error)
- Verify
Document-Isolation-Policy: isolate-and-credentiallessheader is still sent - Drag an image from desktop onto the editor — client-side media processing still works
@adamsilverstein commented on PR #11291:
4 months ago
#18
Added a proposed commit message to the PR description.
@westonruter commented on PR #11291:
4 months ago
#19
Why are images the one exception that don't need crossorign=anonymous? Why don't VIDEO, AUDIO, et al specifically _not_ require it?
## Summary
Document-Isolation-Policy: isolate-and-credentiallesson Chrome 137+ for cross-origin isolationwp_get_chrome_major_version()helper,wp_use_document_isolation_policyfilter, andwindow.__documentIsolationPolicyJS flag## Test plan
Document-Isolation-Policy: isolate-and-credentiallessheader in DevTools, no COEP/COOP headers?action=elementor— no isolation headers sentphp -l src/wp-includes/media.phppassesvendor/bin/phpcs src/wp-includes/media.phppassesSee https://github.com/WordPress/gutenberg/pull/75991