Security and privacy

Origin-Agent-Cluster HTTP Header

Indicates whether the origin should use a dedicated browser agent cluster.

Applicability

This field applies to HTTP responses.

Syntax

Origin-Agent-Cluster: ?1

Examples

Origin-Agent-Cluster: ?1

Common use cases

  • Request origin-level process and memory isolation instead of broader site-keyed grouping.
  • Prepare an application to avoid synchronous assumptions across same-site cross-origin documents.

Common mistakes

  • Treating process isolation as an authorization boundary or defense against all side channels.
  • Sending conflicting policy across pages of the same origin and expecting deterministic late changes.

Security considerations

Origin-keyed clustering can reduce shared execution surface, but browser allocation is implementation-dependent and normal web security controls remain essential.

Use the Security Headers Checker to evaluate supported browser-facing protections on a public website.

Detailed guidance

Meaning and behavior

Origin-Agent-Cluster with the structured boolean value ?1 asks the browser to place the response origin in an origin-keyed agent cluster. Agent clusters determine which documents can share certain execution resources and synchronous capabilities. Historically, compatible origins within one site could be grouped more broadly. Origin-keying narrows that grouping and can encourage stronger process separation between sibling origins, although a browser remains free to manage processes according to resource and platform constraints.

The header is a request about isolation architecture, not an access-control decision. It does not grant or deny network requests, protect an endpoint, sanitize messages, or guarantee a dedicated operating-system process. It can also affect legacy assumptions involving document.domain, because origin-keyed documents cannot use that mechanism to relax origins in the same way. Policy is associated with the origin, so inconsistent delivery can produce warnings or behavior determined by the first applicable navigation.

Implementation notes

Audit any use of document.domain, synchronous cross-origin window access, and same-site legacy integrations before enabling the field. Deliver ?1 consistently on every document response for the origin, including errors and alternate routes. Test popup, iframe, worker, and messaging behavior in supported browsers. Measure memory and process implications for applications with many subdomains, but do not infer security guarantees from a process count. Keep COOP, COEP, CSP, CORS, and application authorization configured according to their own purposes. The header can strengthen isolation posture, yet it is only one signal within the browser’s broader agent-cluster model.

Sources