Cross-Origin-Embedder-Policy configured

Without Cross-Origin-Embedder-Policy, the browser cannot verify that cross-origin resources embedded in your page have opted into being loaded, leaving side-channel data leaks open via timing attacks on resource loading behavior. COEP is also the gate for SharedArrayBuffer and performance.measureUserAgentSpecificMemory() — both blocked by default until cross-origin isolation is established. CWE-1021 applies to cross-origin resource embedding without explicit consent. OWASP A05 identifies missing cross-origin isolation headers as a hardening gap for apps processing sensitive data.

Set Cross-Origin-Embedder-Policy in next.config.js. Start with credentialless for compatibility — it allows CDN images and fonts without requiring them to set CORP headers.

// next.config.js
headers: [{
  source: '/(.*)',
  headers: [{
    key: 'Cross-Origin-Embedder-Policy',
    value: 'credentialless'
  }]
}]

Test all third-party embeds (YouTube iframes, payment widgets, chat tools) after deployment — COEP can break embeds that don't set permissive CORP headers. Switch to require-corp only after auditing every embedded resource.