# Cross-Origin-Opener-Policy (/en/docs/web-security/policies/cross-origin-opener-policy) Cross-Origin-Opener-Policy (COOP) lets a document control whether it shares a browsing context group with the windows that open it or that it opens. Setting it severs the `window.opener` link to cross-origin pages, which blocks a class of cross-window attacks and, paired with [COEP](/en/docs/web-security/policies/cross-origin-embedder-policy), enables the cross-origin isolated state that features like `SharedArrayBuffer` require. The safe configuration is a single header line: ```http Cross-Origin-Opener-Policy: same-origin ``` ## How COOP works [#how-coop-works] Windows that can reach each other (an opener and the page it opened) normally share a browsing context group, which lets them touch each other's `window` object. With `Cross-Origin-Opener-Policy: same-origin`, the browser puts your page in its own group whenever the other side is cross-origin, so a cross-origin opener or popup can no longer reach into your window, and you cannot reach into theirs. You set it with the response header. ## How to configure COOP [#how-to-configure-coop] | Value | Status | Effect | | -------------------------- | --------------- | ----------------------------------------------------------------------------------------------------------- | | `unsafe-none` | ❌ Risky | The default. No isolation; cross-origin windows keep their reference. | | `same-origin` | ✅ Good | Full isolation from cross-origin openers and openees. Required for `crossOriginIsolated`. Widely supported. | | `same-origin-allow-popups` | ✅ Good | Isolates from openers, but keeps a reference to popups your page opens (OAuth, payment flows). | | `noopener-allow-popups` | 🧪 Experimental | Severs the opener link even for same-origin popups. In Chrome and Safari; not Firefox. | ## Report-only mode [#report-only-mode] ```http Reporting-Endpoints: coop-endpoint="https://.report.centralcsp.com" ``` ```http Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop-endpoint" ``` The Report-Only header evaluates COOP and emits reports without actually isolating the window, so you can size the impact before anything changes for users. Both the Report-Only header and the `report-to` parameter are Chromium-only, so treat the reports as a Chromium sample of your traffic. ## What it protects against [#what-it-protects-against] A shared browsing context group is an attack surface: a cross-origin opener can script your window, and the shared process is a vector for Spectre-class side-channel attacks. COOP closes that by isolating the window, and it is one half of the cross-origin isolation that re-enables powerful features safely. ## Insecure configurations to avoid [#insecure-configurations-to-avoid] `unsafe-none` is the default and provides no isolation. Leaving it in place means cross-origin openers keep a reference to your window. If you only need to protect openers but still open popups you trust, `same-origin-allow-popups` is the pragmatic middle ground; reserve `unsafe-none` for pages that genuinely depend on cross-origin window access. ## Known bypasses and limitations [#known-bypasses-and-limitations] COOP only governs the opener relationship, not embedding. Controlling who can frame your page is [`frame-ancestors`](/en/docs/web-security/policies/content-security-policy/directives/frame-ancestors), and controlling what you embed is COEP. `noopener-allow-popups` has no Firefox support yet, so do not depend on it cross-browser. ## Risks [#risks] Turning on `same-origin` can break flows that rely on `window.opener`, OAuth popups, payment windows, and some SSO redirects. Roll it out in Report-Only first and watch the reports before you enforce. ## Recommendation [#recommendation] Set `Cross-Origin-Opener-Policy: same-origin`, the value the [OWASP HTTP Headers cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html) recommends. ```http Cross-Origin-Opener-Policy: same-origin ``` It gives full isolation and is one half of what `crossOriginIsolated` requires. If it breaks an OAuth or payment popup flow, fall back to `same-origin-allow-popups`, which keeps the popups you open reachable while still isolating you from cross-origin openers. ## Reporting [#reporting] Add a `report-to="..."` parameter to the header, declare that endpoint in `Reporting-Endpoints`, and the browser emits the [coop report](/en/docs/web-security/reporting-api/reports/coop). CentralCSP collects the [coop stream](/en/docs/platform/monitoring/coop). COOP reporting is Chromium-only: both the `report-to` parameter and the Report-Only header ship in Chromium and nowhere else. The base policy values are standard and widely supported. ## Browser support [#browser-support] The base values are widely supported: `same-origin` and `same-origin-allow-popups` are available across current Chrome, Firefox, and Safari. `noopener-allow-popups` is on the standards track but limited to Chrome and Safari, with no Firefox support. The Report-Only header and the `report-to` parameter are Chromium-only. ## FAQ [#faq] ### What does Cross-Origin-Opener-Policy do? [#what-does-cross-origin-opener-policy-do] COOP lets a document control whether it shares a browsing context group with the windows it opens or that open it. Setting `same-origin` severs the `window.opener` link to cross-origin pages, which blocks a class of cross-window attacks and, paired with COEP, enables the cross-origin isolated state that features like `SharedArrayBuffer` require. ### What is the difference between same-origin and same-origin-allow-popups? [#what-is-the-difference-between-same-origin-and-same-origin-allow-popups] Both isolate your window from cross-origin openers. `same-origin` gives full isolation and puts your page in its own browsing context group, which `crossOriginIsolated` requires. `same-origin-allow-popups` relaxes that one way: it keeps a reference to popups your page opens, so OAuth and payment flows still work while cross-origin openers stay blocked. ## See also [#see-also] * [Cross-Origin-Embedder-Policy (COEP)](/en/docs/web-security/policies/cross-origin-embedder-policy) * [coop report](/en/docs/web-security/reporting-api/reports/coop) * [COOP and COEP explained](/en/blog/coop-coep-cross-origin-isolation) * [Reporting-Endpoints header](/en/docs/web-security/reporting-api/headers/reporting-endpoints) * [COOP monitoring in CentralCSP](/en/docs/platform/monitoring/coop) ## Sources [#sources] * [MDN, Cross-Origin-Opener-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy) * [web.dev, COOP and COEP](https://web.dev/articles/coop-coep) * [OWASP HTTP Headers cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html) * [HTML Living Standard](https://html.spec.whatwg.org/multipage/browsers.html)