Credentialless iframesLimited availability
The credentialless attribute for the <iframe> HTML element loads third-party content in an ephemeral context and does not send any credentials such as cookies. When using cross-origin isolation, this allows you to embed content that does not send Cross-Origin-Embedder-Policy headers.
Not yet supported in all major browsers — check the table and provide a fallback.
Browser support
DesktopChrome
1–109Not supported
110+Supportedsince Feb 7, 2023
Current: 155Edge
12–109Not supported
110+Supportedsince Feb 9, 2023
Current: 154Firefox
✕Not supportedup to 157
Current: 157Safari
✕Not supportedup to 27
Current: 27MobileChrome Android
18–109Not supported
110+Supportedsince Feb 7, 2023
Current: 155Firefox Android
✕Not supportedup to 157
Current: 157Safari iOS
✕Not supportedup to 27
Current: 27How to use
Not supported in Firefox, Safari, Firefox Android, Safari iOS. Use feature detection below and provide a fallback (or a polyfill) for those browsers.
Example
Full syntax and examples are on MDN: credentialless.
Feature detection
JS · check before using
if ("HTMLIFrameElement" in globalThis && "credentialless" in HTMLIFrameElement.prototype) {
// HTMLIFrameElement.credentialless is available
}Documentation (MDN)
Specification
Sub-features
Support for each part of the feature (3). The overall table above shows when the whole feature works.
| Sub-feature | Chrome | Edge | Firefox | Safari | Chrome Android | Firefox Android | Safari iOS |
|---|---|---|---|---|---|---|---|
| HTMLIFrameElement.credentialless | 110 | 110 | ✕ | ✕ | 110 | ✕ | ✕ |
| Window.credentialless | 110 | 110 | ✕ | ✕ | 110 | ✕ | ✕ |
| iframe.credentialless | 110 | 110 | ✕ | ✕ | 110 | ✕ | ✕ |