Cross-Origin-Opener-Policy (COOP), what it does and how to set it

COOP isolates your window from cross-origin openers and popups, defending against cross-window attacks and enabling cross-origin isolation.

Cross-Origin-Opener-Policy (COOP) lets a document control whether it shares a browsing context group with the windows that open it or that it opens. Setting it severs the window.opener link to cross-origin pages, which blocks a class of cross-window attacks and, paired with COEP, enables the cross-origin isolated state that features like SharedArrayBuffer require.

The safe configuration is a single header line:

Cross-Origin-Opener-Policy: same-origin

How COOP works

Windows that can reach each other (an opener and the page it opened) normally share a browsing context group, which lets them touch each other's window object. With Cross-Origin-Opener-Policy: same-origin, the browser puts your page in its own group whenever the other side is cross-origin, so a cross-origin opener or popup can no longer reach into your window, and you cannot reach into theirs. You set it with the response header.

How to configure COOP

Value	Status	Effect
`unsafe-none`	❌ Risky	The default. No isolation; cross-origin windows keep their reference.
`same-origin`	✅ Good	Full isolation from cross-origin openers and openees. Required for `crossOriginIsolated`. Widely supported.
`same-origin-allow-popups`	✅ Good	Isolates from openers, but keeps a reference to popups your page opens (OAuth, payment flows).
`noopener-allow-popups`	🧪 Experimental	Severs the opener link even for same-origin popups. In Chrome and Safari; not Firefox.

Report-only mode

Reporting-Endpoints: coop-endpoint="https://<Endpoint-ID>.report.centralcsp.com"

Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop-endpoint"

The Report-Only header evaluates COOP and emits reports without actually isolating the window, so you can size the impact before anything changes for users. Both the Report-Only header and the report-to parameter are Chromium-only, so treat the reports as a Chromium sample of your traffic.

What it protects against

A shared browsing context group is an attack surface: a cross-origin opener can script your window, and the shared process is a vector for Spectre-class side-channel attacks. COOP closes that by isolating the window, and it is one half of the cross-origin isolation that re-enables powerful features safely.

Insecure configurations to avoid

unsafe-none is the default and provides no isolation. Leaving it in place means cross-origin openers keep a reference to your window.

If you only need to protect openers but still open popups you trust, same-origin-allow-popups is the pragmatic middle ground; reserve unsafe-none for pages that genuinely depend on cross-origin window access.

Known bypasses and limitations

COOP only governs the opener relationship, not embedding. Controlling who can frame your page is frame-ancestors, and controlling what you embed is COEP. noopener-allow-popups has no Firefox support yet, so do not depend on it cross-browser.

Risks

Turning on same-origin can break flows that rely on window.opener, OAuth popups, payment windows, and some SSO redirects. Roll it out in Report-Only first and watch the reports before you enforce.

Recommendation

Set Cross-Origin-Opener-Policy: same-origin, the value the OWASP HTTP Headers cheat sheet recommends.

Cross-Origin-Opener-Policy: same-origin

It gives full isolation and is one half of what crossOriginIsolated requires. If it breaks an OAuth or payment popup flow, fall back to same-origin-allow-popups, which keeps the popups you open reachable while still isolating you from cross-origin openers.

Reporting

Add a report-to="..." parameter to the header, declare that endpoint in Reporting-Endpoints, and the browser emits the coop report. CentralCSP collects the coop stream.

COOP reporting is Chromium-only: both the report-to parameter and the Report-Only header ship in Chromium and nowhere else. The base policy values are standard and widely supported.

Browser support

The base values are widely supported: same-origin and same-origin-allow-popups are available across current Chrome, Firefox, and Safari. noopener-allow-popups is on the standards track but limited to Chrome and Safari, with no Firefox support. The Report-Only header and the report-to parameter are Chromium-only.

FAQ

What does Cross-Origin-Opener-Policy do?

COOP lets a document control whether it shares a browsing context group with the windows it opens or that open it. Setting same-origin severs the window.opener link to cross-origin pages, which blocks a class of cross-window attacks and, paired with COEP, enables the cross-origin isolated state that features like SharedArrayBuffer require.

What is the difference between same-origin and same-origin-allow-popups?

Both isolate your window from cross-origin openers. same-origin gives full isolation and puts your page in its own browsing context group, which crossOriginIsolated requires. same-origin-allow-popups relaxes that one way: it keeps a reference to popups your page opens, so OAuth and payment flows still work while cross-origin openers stay blocked.

Cross-Origin-Opener-Policy