coop report, payload and fields

The coop report fires when Cross-Origin-Opener-Policy isolates a window or a cross-origin script tries to reach across the boundary.

A coop report tells you that Cross-Origin-Opener-Policy (COOP) acted: either a navigation switched browsing context groups, or, in report-only mode, a cross-origin script tried to access a property across the COOP boundary. It is how you size the impact of turning COOP on, and how you spot cross-window access you did not expect.

Experimental

COOP reporting is still being standardized, and the body field names vary between the explainer, the spec, and Chromium. Treat the payload below as indicative and confirm against a live capture.

When the browser sends it

COOP emits two families of report. Navigation reports fire when a navigation causes a browsing-context-group switch (the isolation COOP is there to enforce). Access reports, which are report-only, fire when a cross-origin script tries to read a property across the COOP boundary, the cross-window access COOP blocks. Use the Cross-Origin-Opener-Policy-Report-Only header to observe both without actually isolating.

Payload example

{
  "type": "coop",
  "age": 9,
  "url": "https://api-next.centralcsp.com/",
  "user_agent": "Mozilla/5.0 ...",
  "body": {
    "disposition": "enforce",
    "effectivePolicy": "same-origin",
    "nextResponseURL": "https://attacker.example/",
    "referrer": "https://api-next.centralcsp.com/",
    "type": "navigation-from-response"
  }
}

Every coop report body carries these fields inside the shared report envelope.

Field reference

Field	Meaning
`disposition`	`enforce`, or `report` for a report-only access report.
`effectivePolicy`	The COOP value in force, for example `same-origin`.
`previousResponseURL` / `nextResponseURL`	The documents on each side of a navigation report (sanitized).
`referrer`	The navigation referrer.
`property`	(Access reports) the property the cross-origin script tried to read.
`openerURL` / `openeeURL` / `otherDocumentURL`	(Access reports) the other document involved (sanitized).
`sourceFile`, `lineNumber`, `columnNumber`	(Access reports) where the access came from.
`type`	The variant marker (a navigation or access variant).

How to receive it

Add a report-to="..." parameter to the COOP header (or its Report-Only variant) and declare that endpoint in Reporting-Endpoints. CentralCSP collects the coop stream.

Reporting-Endpoints: coop-endpoint="https://<Endpoint-ID>.report.centralcsp.com"

Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop-endpoint"

What it tells you about security

Navigation reports show where turning on isolation would change link and popup behavior, the breakage to fix before enforcing. Access reports are the security signal: they reveal cross-origin scripts probing your window, which is exactly the cross-window leakage COOP exists to stop.

Gotchas

The exact top-level body shape and the variant marker key are not settled across sources. Capture a real report before documenting field names as final.

Browser support

The base COOP values are standard and broadly supported, but COOP reporting is Chromium-only: the reports are delivered through the report-to parameter on the header, and Firefox and Safari do not send them. The restrict-properties value is also Chromium-led.

COOP report