# Cross Origin Isolation Guidance

**URL:** <https://devforum.zoom.us/t/cross-origin-isolation-guidance/53770>\
**Category:** Web\
**Created:** [July 7, 2021, 4:19pm UTC](https://devforum.zoom.us/t/cross-origin-isolation-guidance/53770 "2021-07-07T16:19:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![victor.aprea](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/victor.aprea/32/26777_2.png) [@victor.aprea](https://devforum.zoom.us/u/victor.aprea)\
**Post date:** [July 7, 2021, 4:19pm UTC](https://devforum.zoom.us/t/cross-origin-isolation-guidance/53770/1 "2021-07-07T16:19:59Z")

</div>

Zoom Dev team, this Cross Origin Isolation business is all very foreign to my team. I went so far as to try and follow the guidance of adding the requisite headers to our NGINX configuration and registering our domain for `SharedArrayBuffers` origintrials:

> add\_header ‘cross-origin-resource-policy’ ‘\*’;  
> add\_header ‘Cross-Origin-Embedder-Policy’ ‘require-corp’;  
> add\_header ‘Cross-Origin-Opener-Policy’ ‘same-origin’;

But that seems to break a lot of diverse features of our application, even something as simple as Google Login. We get a variety of failures in the devtools console like this as an example:

> GET [https://player.vimeo.com/api/player.js](https://player.vimeo.com/api/player.js) net::ERR\_BLOCKED\_BY\_RESPONSE.NotSameOriginAfterDefaultedToSameOriginByCoep

Is there some way we can get more hands-on support for making Zoom work in our application without breaking the rest of our application, or for helping us make the rest of our application continue to work given these new constraints? Please advise.

---

<div class="post-metadata">

**Author:** ![vic.yang](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/vic.yang/32/24656_2.png) [@vic.yang](https://devforum.zoom.us/u/vic.yang)\
**Post date:** [July 8, 2021, 7:46am UTC](https://devforum.zoom.us/t/cross-origin-isolation-guidance/53770/2 "2021-07-08T07:46:54Z")

</div>

Hey @victor.aprea

Thanks for your feedback.

You can apply [an origin trial](https://developer.chrome.com/blog/enabling-shared-array-buffer/#origin-trial) first, Chrome team is still working on the new policy for `SharedArrayBuffer`.

Thanks  
Vic

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [August 7, 2021, 5:47pm UTC](https://devforum.zoom.us/t/cross-origin-isolation-guidance/53770/3 "2021-08-07T17:47:51Z")

</div>

Closed on August 7, 2021, 5:47pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.