COOP
Navigations and window accesses your opener policy affected. The reports that tell you whether enforcing will break a popup-based login.
Last update:
Cross-Origin-Opener-Policy severs the link between your page and windows it opens, or that opened it. This lists the interactions it affected.
COOP events are grouped by kind, each with the effective policy that applied:
Columns
The report table has these columns:
| Column | What it means |
|---|---|
| Kind | The kind of COOP event |
| Effective policy | The policy actually in force for that document |
| Document origin | The page involved |
| Browsers | Browsers that reported it |
| Disposition | Enforced means applied, Report-only means it would have been |
| Reports | Reports collapsed into this row |
| Last seen | Most recent occurrence |
Drilling in adds Property, the specific window property that was accessed, along with the popup URL and the next document.
Check popup-based flows first
COOP breaks cross-window scripting, and the flows that rely on it are the ones you least want to break.
Look for entries whose Property is postMessage, closed, or opener, and trace them to the feature that produced them. In practice that means OAuth and SSO popup logins, payment provider popups, and anything that opens a window and waits for it to report back.
These are worth walking manually before enforcing rather than trusting the report count, since a login popup used by a fraction of your users generates few reports and breaks completely.
The default policy
The generated header block sets the strict value:
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="default"same-origin is the strict setting and the one isolation requires. If a flow genuinely needs to keep its opener link, same-origin-allow-popups preserves it for windows you open while still severing incoming ones:
-Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="default"
+Cross-Origin-Opener-Policy-Report-Only: same-origin-allow-popups; report-to="default"same-origin-allow-popups does not qualify for cross-origin isolation. Choosing it is choosing the flow over SharedArrayBuffer.
Enforce together with COEP
Isolation needs both enforced. Clear COEP first, since it depends on third parties and takes longer, then switch both headers in one change.