Media: Use Document-Isolation-Policy for cross-origin isolation#11098
Media: Use Document-Isolation-Policy for cross-origin isolation#11098adamsilverstein wants to merge 12 commits intoWordPress:trunkfrom
Conversation
Replace COEP/COOP headers with Document-Isolation-Policy on Chrome 137+ for cross-origin isolation. DIP provides per-document isolation without breaking third-party page builder iframes that rely on same-origin DOM access. Non-DIP browsers skip isolation entirely since COEP/COOP caused CORS failures for embeds and broke plugins like Elementor.
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
Without Document-Isolation-Policy, SharedArrayBuffer is unavailable and wasm-vips cannot run. Gate the entire feature (JS flags + module registration) behind the DIP check so browsers that lack support don't attempt to use client-side processing at all.
Cover wp_get_chrome_major_version(), the output buffer, and wp_set_up_cross_origin_isolation() including DIP detection, browser gating, filter overrides, and third-party editor skip logic.
Remove __documentIsolationPolicy JS flag and DIP early-return from wp_set_client_side_media_processing_flag(). Update docblocks and comments to reflect DIP-only cross-origin isolation.
Tests that flush output buffers call header() which fails when PHPUnit has already sent output. Adding @runInSeparateProcess prevents "headers already sent" errors.
Sets window.__documentIsolationPolicy when DIP is active so JS can distinguish DIP from COOP/COEP cross-origin isolation and skip unnecessary iframe credentialless attributes.
… output ob_get_flush() returns the original unprocessed buffer content, not the callback-processed result. Use a nested buffer approach instead: start an outer buffer, flush the inner buffer (triggering the callback), then get the processed content from the outer buffer. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
DIP headers are sent based on browser capability alone. The existing wp_client_side_media_processing_enabled filter already gates the entire feature higher in the call chain.
|
@swissspidy should we try to get this in before beta 3? |
|
Per WordPress/gutenberg#75991 (comment):
|
|
Beta 3 would be good timing for sure. But yes need to check the Chromium question. |
Chromestatus: https://chromestatus.com/feature/5141940204208128 Here is what Claude summarized: Despite WebKit saying Negative on the status page, that doesn't seem accurate. They seem undecided and have yet to offer an alternative. We can offer limited support for Firefox/Safari via a plugin. |
3 participants
https://core.trac.wordpress.org/ticket/64766
Summary
Replaces
Cross-Origin-Embedder-Policy/Cross-Origin-Opener-Policy(COEP/COOP) headers withDocument-Isolation-Policy: isolate-and-credentiallessfor cross-origin isolation in the block editor.DIP is a per-document isolation mechanism available in Chromium 137+ that avoids the breakage COEP/COOP caused for third-party plugins whose iframes lost credentials and DOM access.
What changed
credentiallessattribute on iframes, iframe content observation, and embed preview filtering are all removed — DIP doesn't need them.__documentIsolationPolicyJS flag: No longer needed since there's only one code path.crossorigin="anonymous"still added to subresources via mutation observer.wp_use_document_isolation_policyfilter available for customization.wp_get_chrome_major_version()helper added for Chrome version detection.Browser support
Test plan
Document-Isolation-Policy: isolate-and-credentiallessheader in DevTools (no COEP/COOP headers)window.crossOriginIsolated === truein consolephp -l src/wp-includes/media.phppassesvendor/bin/phpcs src/wp-includes/media.phppassesSee WordPress/gutenberg#75991
Trac ticket: https://core.trac.wordpress.org/ticket/64766
Plugin to enable COEP/COOP support for safari/firefox - https://github.com/adamsilverstein/client-side-media-experiments