Anonymous iframe: relation with COEP credentialless

[antosart]

Should an iframe loaded inside a page with COEP: credentialless be automatically anonymous, or does it have to specify the attribute credentials=omit explicitly?

The former matches better the behaviour of other subresources and could be a bit easier to deploy.

But if we go with the former, would that be a way to override it, like specifying credentials=include?

[camillelamy]

Right now, the two concepts are different. An iframe embedded inside a page with COEP credentialless is not anonymous, unless explicitly declared to be so. Considering that COEP credentialless is meant to be deployed over first-party documents, which might also embed first party iframes, we thought it was not desirable to have those frames be by default anonymous.