HTTP Security Headers

Cross-Origin-Opener-Policy (COOP)

Cuts the scripting link between your page and any cross-origin window that opened it, blocking a class of cross-site information leaks.

What it is

By default, a page opened via window.open() or a target=_blank link shares a browsing-context group with its opener, so the two windows hold scriptable references to each other (window.opener). Cross-Origin-Opener-Policy (COOP) can break that link when the opener is cross-origin, placing your document in its own isolated group.

Values

unsafe-none
Default. No isolation; keeps the opener relationship.
same-origin-allow-popups
Isolates from cross-origin openers but keeps references to popups this page opens.
same-origin
Full isolation — only same-origin documents share the browsing-context group. Required for cross-origin isolation.
HTTP RESPONSE HEADER
Cross-Origin-Opener-Policy: same-origin

Half of cross-origin isolation

COOP: same-origin combined with COEP: require-corp makes a document 'cross-origin isolated', which re-enables powerful APIs like SharedArrayBuffer and high-resolution timers.

Why it matters

  • It mitigates cross-window attacks (XS-Leaks, tabnabbing) that rely on a cross-origin opener holding a reference to your page.
  • Together with COEP it unlocks cross-origin isolation, required for SharedArrayBuffer and precise performance.now() timers.
  • It reduces the risk that a page you link to (or that links to you) can probe your window's state.

Common mistakes

  • Setting same-origin on a page that legitimately depends on window.opener (e.g. an OAuth popup flow), which then breaks.
  • Expecting cross-origin isolation from COOP alone — you also need Cross-Origin-Embedder-Policy: require-corp.
  • Not testing popup-based integrations after enabling it, since references to opened windows may be severed.

How WebInspect checks this

  • WebInspect reports the COOP value and whether the page is a candidate for cross-origin isolation.
  • It notes when COOP is set but the companion Cross-Origin-Embedder-Policy is missing, so isolation is not actually achieved.
  • It flags unsafe-none on sensitive pages where isolation would be beneficial.