Strict Origin Isolation
Table of Contents
Strict Origin Isolation
Strict Origin Isolation control
| Prisma Browser Desktop | Prisma Browser Extension | Prisma Browser for Mobile |
|---|---|---|
| Full support | No support | No support |
Isolates every origin in its own agent-cluster, preventing scripts on one sub-domain
from interacting with another.
The Prisma Browser uses a security model called agent clustering, which
isolates each browser tab. When Site Isolation is enabled, the browser places
each unique origin into its own cluster (eTLD), improving security by preventing
cross-domain scripting. This change disables older techniques like
document.domain.
If Site Isolation is disabled, Prisma Browser allows pages with the same
eTLD+1 to share a cluster—supporting legacy features but weakening security.
Enable Site Isolation for stronger
protection; use the legacy mode only when necessary for older
applications.
eTLD: The effective public suffix. The eTLD of
docs.google.com is google.com.
eTLD+1: The eTLD plus the next suffix
to the left. The eTLD+1 of google.com can be mail.google.com.
- From Strata Cloud Manager, selectSelect Strict Origin Isolation.Select one of the following options:
- Enable - Enabling stricter cross-origin isolation strengthens defenses against Spectre and XS-Leak attacks and is a necessary step for features like high-resolution SharedArrayBuffer. However, it may break legacy applications that rely on document.domain for cross-subdomain communication.
- Disable - All pages that share the same eTLD+1 can still join one cluster. While this works for older, multi sub-domain apps, it provides more chance data leaks between sub-domains.
Click Set.![]()
