Use when reviewing security-sensitive web apps, SharedArrayBuffer usage, worker-heavy apps, editors, or measurement features that require cross-origin isolation. Check both headers and real browser behavior.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Cross-origin isolation reduces opener-based attacks and XS-Leak risk, and it is required for powerful browser features such as SharedArrayBuffer in modern browsers. It also breaks integrations if deployed carelessly, so it needs a deliberate rollout rather than a copy-pasted header block.
Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy together when you need cross-origin isolationCross-Origin-Resource-Policy as appropriateself.crossOriginIsolated === true before depending on isolated-only featuresReview security headers and embedded resources for cross-origin isolation. Check whether the app needs COOP/COEP, whether resources are compatible with COEP, and whether the runtime actually becomes crossOriginIsolated.
Add COOP and COEP only after auditing dependencies, ensure subresources use CORP or CORS as required, and verify the final document becomes crossOriginIsolated in the browser.
Explain how COOP, COEP, and CORP work together, what they protect against, and why third-party embeds often block a successful rollout.
Review server headers, third-party integrations, popups, workers, and asset responses related to Use COOP, COEP, and CORP for cross-origin isolation when needed. Flag exact responses or integrations that would block isolation or break once isolation is enforced.
For full implementation details, code examples, and framework-specific guidance,
see references/rule.md.
Rule page: https://frontendchecklist.io/rules/security/cross-origin-isolation
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Use when reviewing templates, rendered HTML, or shared components related to Create a custom 404 error page. Validate the final browser-facing markup, not just the source framework abstraction.
日本語の概要は準備中です。原文の説明を表示しています。
Use when auditing metadata, crawlability, structured data, or indexability related to Create a dedicated About page. Verify the rendered HTML and HTTP response rather than relying only on source files.
日本語の概要は準備中です。原文の説明を表示しています。
Use when reviewing component libraries, page flows, or CI pipelines that need repeatable accessibility checks. Automated testing is strongest at catching structural and attribute-level issues; it does not replace keyboard, screen reader, and manual UX testing.
日本語の概要は準備中です。原文の説明を表示しています。
Use when reviewing sign-in, sign-up, MFA, CAPTCHA, recovery, and re-auth flows. Evaluate the full authentication path, including error handling and backup methods, not just the primary login form.
日本語の概要は準備中です。原文の説明を表示しています。
Use when reviewing templates, rendered HTML, or shared components related to Make notifications accessible. Validate the final browser-facing markup, not just the source framework abstraction.
日本語の概要は準備中です。原文の説明を表示しています。
Use when reviewing rendered HTML, interactive components, or design-system patterns related to Use semantic table markup for screen readers. Check native semantics first, then inspect keyboard behavior, focus flow, accessible names, and screen-reader output where relevant.
日本語の概要は準備中です。原文の説明を表示しています。