# COOP (/en/docs/platform/monitoring/coop)





`Cross-Origin-Opener-Policy` severs the link between your page and windows it opens, or that opened it. This lists the interactions it affected.

COOP events are grouped by kind, each with the effective policy that applied:

<img alt="COOP events grouped by kind, each with the effective policy that applied" src="__img0" width="1359" height="420" />

## Columns [#columns]

The report table has these columns:

| Column               | What it means                                                |
| -------------------- | ------------------------------------------------------------ |
| **Kind**             | The kind of COOP event                                       |
| **Effective policy** | The policy actually in force for that document               |
| **Document origin**  | The page involved                                            |
| **Browsers**         | Browsers that reported it                                    |
| **Disposition**      | Enforced means applied, Report-only means it would have been |
| **Reports**          | Reports collapsed into this row                              |
| **Last seen**        | Most recent occurrence                                       |

Drilling in adds **Property**, the specific window property that was accessed, along with the popup URL and the next document.

## Check popup-based flows first [#check-popup-based-flows-first]

COOP breaks cross-window scripting, and the flows that rely on it are the ones you least want to break.

Look for entries whose **Property** is `postMessage`, `closed`, or `opener`, and trace them to the feature that produced them. In practice that means OAuth and SSO popup logins, payment provider popups, and anything that opens a window and waits for it to report back.

These are worth walking manually before enforcing rather than trusting the report count, since a login popup used by a fraction of your users generates few reports and breaks completely.

## The default policy [#the-default-policy]

The generated header block sets the strict value:

```http
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="default"
```

`same-origin` is the strict setting and the one isolation requires. If a flow genuinely needs to keep its opener link, `same-origin-allow-popups` preserves it for windows you open while still severing incoming ones:

```diff
-Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="default"
+Cross-Origin-Opener-Policy-Report-Only: same-origin-allow-popups; report-to="default"
```

`same-origin-allow-popups` does not qualify for cross-origin isolation. Choosing it is choosing the flow over `SharedArrayBuffer`.

## Enforce together with COEP [#enforce-together-with-coep]

Isolation needs both enforced. Clear [COEP](/en/docs/platform/monitoring/coep) first, since it depends on third parties and takes longer, then switch both headers in one change.

## Next steps [#next-steps]

* [COEP](/en/docs/platform/monitoring/coep)
* [Cross-Origin-Opener-Policy reference](/en/docs/web-security/policies/cross-origin-opener-policy)