Home / Knowledge hub / Cross-Origin-Opener-Policy
Knowledge hub
Cross-Origin-Opener-Policy
A header that isolates your page from windows opened by other sites.
What it means
Cross-Origin-Opener-Policy, or COOP, is a response header that puts your page in its own browsing context group. Windows opened from other sites lose their link to it, and so do windows your page opens to other sites. They can no longer reach each other through window.opener or related references.
The main values are unsafe-none, the old default that changes nothing, same-origin-allow-popups, which keeps links to pop-ups your page opens, and same-origin, the strictest, which cuts every link to windows from other origins.
Why it matters
Without isolation, a page you open, or one that opens yours, keeps a handle on your window. That feeds tabnabbing, where a background tab is quietly redirected, and cross-site leaks, which learn private facts about a signed-in user from the way windows behave.
It also sits behind modern speculative-execution defences. Browsers only unlock features such as high-resolution timers and shared memory for pages that are cross-origin isolated, which needs COOP together with COEP.
How it shows up
You meet it as a header such as Cross-Origin-Opener-Policy: same-origin on pages with sensitive actions, and as a required pair with COEP for apps that need cross-origin isolation. Payment pop-ups and OAuth sign-in windows depend on the opener link, so they need same-origin-allow-popups.
The mistakes repeat. Turning on same-origin and breaking a login pop-up or a payment window. Setting it only on the home page. Treating it as a replacement for rel="noopener" on links. Trial it on a few routes and watch what stops working.
Questions people ask
Cross-Origin-Opener-Policy, answered
Does COOP break pop-up sign-ins?
It can. A strict policy cuts the link between your page and a window opened by a provider, so the sign-in cannot report back.
Use same-origin-allow-popups, or test your flows before rollout.
What is the difference between COOP and COEP?
COOP controls windows that open each other. COEP controls what resources your page may load from other origins.
Cross-origin isolation requires both.
Is COOP the same as noopener?
Related. rel="noopener" cuts the link for one link you add. COOP applies to the whole page and also covers windows others open to you.
Use both.
Which sites need COOP?
Pages with account actions, payment or sensitive data benefit most. Apps that use SharedArrayBuffer or precise timers need it for isolation.
A brochure site gains little.
How do we test it?
Check the header with developer tools, then open your page from a test page on another origin and see whether the opener reference is null.
A pentest can include this where cross-window access matters.
Sources
Where this comes from
Related
Terms that sit next to this one
Cross-Origin-Embedder-Policy
A header requiring embedded resources to opt in before your page will load them.
Tabnabbing
A link you opened silently changes the page that opened it, to a fake sign-in.
Cross-site leaks
Small side effects, like timing or errors, that let another site infer private data.
Same-origin policy
The browser rule that stops one site's scripts reading another site's data.
Security headers
Response headers that switch on browser protections against common web attacks.
Can other windows reach yours?
Cross-window leaks and missing isolation matter most where an action is sensitive, so we test them on the running app and report only what we showed working. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.