# COOP report (/en/docs/web-security/reporting-api/reports/coop)



A `coop` report tells you that [Cross-Origin-Opener-Policy (COOP)](/en/docs/web-security/policies/cross-origin-opener-policy) acted: either a
navigation switched browsing context groups, or, in report-only mode, a cross-origin
script tried to access a property across the COOP boundary. It is how you size the
impact of turning COOP on, and how you spot cross-window access you did not expect.

<Callout type="warn" title="Experimental">
  COOP reporting is still being standardized, and the body field names vary between the explainer, the spec, and Chromium. Treat the payload below as indicative and confirm against a live capture.
</Callout>

## When the browser sends it [#when-the-browser-sends-it]

COOP emits two families of report. **Navigation reports** fire when a navigation
causes a browsing-context-group switch (the isolation COOP is there to enforce).
**Access reports**, which are report-only, fire when a cross-origin script tries to
read a property across the COOP boundary, the cross-window access COOP blocks. Use
the `Cross-Origin-Opener-Policy-Report-Only` header to observe both without actually
isolating.

## Payload example [#payload-example]

```json
{
  "type": "coop",
  "age": 9,
  "url": "https://example.com/",
  "user_agent": "Mozilla/5.0 ...",
  "body": {
    "disposition": "enforce",
    "effectivePolicy": "same-origin",
    "nextResponseURL": "https://attacker.example/",
    "referrer": "https://example.com/",
    "type": "navigation-from-response"
  }
}
```

Every `coop` report body carries these fields inside the shared report envelope.

## Field reference [#field-reference]

| Field                                          | Meaning                                                              |
| ---------------------------------------------- | -------------------------------------------------------------------- |
| `disposition`                                  | `enforce`, or `report` for a report-only access report.              |
| `effectivePolicy`                              | The COOP value in force, for example `same-origin`.                  |
| `previousResponseURL` / `nextResponseURL`      | The documents on each side of a navigation report (sanitized).       |
| `referrer`                                     | The navigation referrer.                                             |
| `property`                                     | (Access reports) the property the cross-origin script tried to read. |
| `openerURL` / `openeeURL` / `otherDocumentURL` | (Access reports) the other document involved (sanitized).            |
| `sourceFile`, `lineNumber`, `columnNumber`     | (Access reports) where the access came from.                         |
| `type`                                         | The variant marker (a navigation or access variant).                 |

## How to receive it [#how-to-receive-it]

Add a `report-to="..."` parameter to the COOP header (or its Report-Only variant)
and declare that endpoint in [`Reporting-Endpoints`](/en/docs/web-security/reporting-api/headers/reporting-endpoints). CentralCSP collects the
[coop stream](/en/docs/platform/monitoring/coop).

```http
Reporting-Endpoints: coop-endpoint="https://<Endpoint-ID>.report.centralcsp.com"
```

```http
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop-endpoint"
```

## What it tells you about security [#what-it-tells-you-about-security]

Navigation reports show where turning on isolation would change link and popup
behavior, the breakage to fix before enforcing. Access reports are the security
signal: they reveal cross-origin scripts probing your window, which is exactly the
cross-window leakage COOP exists to stop.

## Gotchas [#gotchas]

<Callout type="info">
  The exact top-level body shape and the variant marker key are not settled across sources. Capture a real report before documenting field names as final.
</Callout>

## Browser support [#browser-support]

The base COOP values are standard and broadly supported, but COOP reporting is
Chromium-only: the reports are delivered through the `report-to` parameter on the
header, and Firefox and Safari do not send them. The `restrict-properties` value is
also Chromium-led.

## See also [#see-also]

* [Cross-Origin-Opener-Policy (COOP)](/en/docs/web-security/policies/cross-origin-opener-policy)
* [coep report](/en/docs/web-security/reporting-api/reports/coep)
* [COOP monitoring in CentralCSP](/en/docs/platform/monitoring/coop)
* [Reporting-Endpoints header](/en/docs/web-security/reporting-api/headers/reporting-endpoints)
* [The report delivery format](/en/docs/web-security/reporting-api/concepts/report-delivery-format)

## Sources [#sources]

* [MDN, Reporting API](https://developer.mozilla.org/en-US/docs/Web/API/Reporting_API)
* [COOP reporting explainer](https://github.com/camillelamy/explainers/blob/main/coop_reporting.md)
* [MDN, Cross-Origin-Opener-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy)