Cross-origin isolation

Origin-Agent-Cluster

Build a config with this header →

By default the browser groups same-site documents (a.example.com and b.example.com) into one agent cluster, where they can share memory and synchronously reach each other via document.domain. Origin-Agent-Cluster: ?1 opts this origin out: it gets origin-keyed isolation, document.domain becomes a no-op, and the browser is free to give it its own process. That's a defence-in-depth win against cross-origin side-channels and a small performance/memory hint. The value is a structured-field boolean — ?1 on, ?0 off — and the browser applies the *first* setting it sees per origin, so send it consistently on every response from that origin. MDN

Example

Origin-Agent-Cluster: ?1

Options

OptionTypeDefaultNotes
value select (?1 / ?0) ?1 Only turn this off if you deliberately rely on document.domain across subdomains.

Scoring

Contributes up to 1 point to your grade (a bonus header — not required for an A+).

Full specification on MDN ↗