Browser setup

Browser storage belongs to an origin, defined by its scheme, hostname, and port. Serve production apps over HTTPS and use localhost for development. Worker APIs that rely on SharedArrayBuffer also need cross-origin isolation. Send these response headers:

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

Detect unavailable features before allocating user data, and show errors instead of attempting destructive recovery.