[wp-trac] [WordPress Trac] #64803: Media: Skip cross-origin isolation for third-party page builders

[WordPress Trac]

#64803: Media: Skip cross-origin isolation for third-party page builders
-----------------------------+-----------------------------
 Reporter:  adamsilverstein  |      Owner:  adamsilverstein
     Type:  defect (bug)     |     Status:  assigned
 Priority:  normal           |  Milestone:  Awaiting Review
Component:  Media            |    Version:  trunk
 Severity:  normal           |   Keywords:
  Focuses:                   |
-----------------------------+-----------------------------
 In 7.0, WordPress is adding headers to enable cross-origin isolation for
 the block editor, unlocking `SharedArrayBuffer` for client-side media
 processing.

 DIP or COEP/COOP headers isolate the document into its own agent cluster,
 which blocks same-origin iframe access. Third-party page builders (e.g.
 Elementor, Beaver Builder, Divi) that override the block editor typically
 rely on same-origin iframes and would break under DIP.

 These page builders register custom `action` query parameters (e.g.
 `action=elementor`) to load their editor instead of the block editor. This
 ticket adds a check to client side media when a non-`edit` action
 parameter is detected on the post editing screen.

 '''Open question:''' Some editors like Web Stories use `action=edit` but
 replace the block editor entirely. The current check would still apply DIP
 in that case. We may need a filter or an alternative detection mechanism
 to handle this edge case.

 '''PR:''' [https://github.com/WordPress/wordpress-develop/pull/11170 PR
 #11170]

 See also: [https://github.com/WordPress/wordpress-
 develop/pull/11098#discussion_r2064009989 discussion on PR #11098]

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/64803>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform