Allow setting COOP and COEP headers in Github Pages #13309

josephrocca · 2022-03-23T06:22:14Z

josephrocca
Mar 23, 2022

In order to use SharedArrayBuffer and WebAssembly Threads, COOP and COEP headers need to be set, such that the page becomes cross-origin isolated (explanation at web.dev). Since Wasm is becoming well supported across browsers, many libraries (e.g. image editing, ML) and applications are starting to use it, and so the inability to set these headers in Github Pages is becoming a bigger and bigger problem (for me, at least).

Note that there are hacky workarounds, like this: https://github.com/gzuidhof/coi-serviceworker But these can cause a bunch of other problems. I think the emergence of libraries like that (which explicitly mention Github Pages in their README) is evidence enough that this feature should be added.

Thanks!

mithrendal · 2022-10-10T19:09:04Z

mithrendal
Oct 10, 2022

I want this too ...

0 replies

josephrocca · 2022-10-11T04:52:24Z

josephrocca
Oct 11, 2022
Author

For people who want a quick and very hacky workaround, include this script in your <head>:

https://github.com/josephrocca/clip-image-sorter/blob/main/enable-threads.js

(Note: You can't paste it inline - it needs to be in a separate script file and imported like <script src="enable-threads.js"></script>)

3 replies

utkrssh Mar 7, 2023

This works in Chrome, but not in Firefox. Any idea why?

utkrssh Mar 15, 2023

Setting require-corp instead of credentialless as Cross-Origin-Embedder-Policy makes it works in both, Chrome and Firefox.

josephrocca Jun 22, 2023
Author

Yep, credentialless is the best value to use here (because it doesn't block loading images from a cross-domain CDN, and other stuff like that), but it's quite new and not supported on Firefox or Safari yet, as of writing: https://caniuse.com/mdn-http_headers_cross-origin-embedder-policy_credentialless

mithrendal · 2022-10-11T19:41:43Z

mithrendal
Oct 11, 2022

@josephrocca my app is already using an own service worker which would conflict with the one you proposed... I also already tricked it to overwrite the headers ... nonetheless this feels still very hacky ... would prefer a straight forward solution where github would offer to allow to enable us COOP and COEP headers. Your script is interesting, mine for example did not consider request.mode == 'no-cors' ... thank you very much 👍, will continue to study and learn from it

0 replies

coatless · 2023-03-14T17:47:44Z

coatless
Mar 14, 2023

Any thoughts as to whether something akin to Netlify's header specification could be added? The lack of being able to address Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) on a pro-developer portal is surprising.

0 replies

yoannchaudet · 2023-07-10T15:04:41Z

yoannchaudet
Jul 10, 2023
Collaborator

Hello,

This is a scenario we would support with custom headers. No ETA at the moment as to when this feature will be available.

3 replies

coatless Jul 18, 2023

Wonderful! Could we expect an approach like Netlify's header specification _headers to specify the custom header? Also, is there a way to look at a roadmap or public timeline view for updates? Or will you be updating the progress in this thread?

Cundiff7 Feb 2, 2024

Hi :)
Has there been any update to the timing of this feature? Thanks!

HarikrishnanBalagopal Feb 23, 2024

Same question here. Trying to use SharedArrayBuffer with Atomics.wait for async stuff in WebAssembly.
However since Github Pages isn't crossOriginIsolated it's not available.

Any update on if we can get at least a CORS headers checkbox in the Settings > GH Pages tab of a repo?

stereomatchingkiss · 2024-02-03T04:29:28Z

stereomatchingkiss
Feb 3, 2024

Hi :) Has there been any update to the timing of this feature? Thanks!

Use netlify

3 replies

Cundiff7 Feb 3, 2024

I ported to netlify, but i am still having trouble. My goal is to embed an HTML 5 game onto a webpage via itch.io. I have tried a few different things for the headers, but have not had luck. Any tips?

utkrssh Feb 4, 2024

[[headers]]
for = "/*"
  [headers.values]
    Cross-Origin-Opener-Policy = "same-origin"
    Cross-Origin-Embedder-Policy = "require-corp"

This had worked for me.

Cundiff7 Feb 7, 2024

I will check it out, thanks!

This comment was marked as spam.

Sign in to view

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GitHub Community

Allow setting COOP and COEP headers in Github Pages #13309

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 7 comments 9 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

This comment was marked as spam.

Select a reply

Allow setting COOP and COEP headers in Github Pages #13309

Replies: 7 comments · 9 replies

josephrocca Oct 11, 2022 Author

josephrocca Jun 22, 2023 Author

yoannchaudet Jul 10, 2023 Collaborator

This comment was marked as spam.

Replies: 7 comments 9 replies

josephrocca
Oct 11, 2022
Author

josephrocca Jun 22, 2023
Author

yoannchaudet
Jul 10, 2023
Collaborator