Skip to main content

Cross-Origin-Opener-Policy

ResponseActive

Cross-Origin-Opener-Policy (COOP) isolates the browsing context from cross-origin documents. Setting it to 'same-origin' prevents other origins from getting a reference to the window (window.opener), protecting against cross-origin information leakage. COOP is required alongside COEP to enable SharedArrayBuffer and high-resolution timers (Spectre mitigation).

Cross-Origin-Opener-Policy: unsafe-none | same-origin-allow-popups | same-origin

Description

COOP controls which documents share a browsing context group. 'same-origin' means only same-origin documents can share the group – cross-origin documents open in a new group with no window.opener reference. This is required to enable cross-origin isolation, which unlocks SharedArrayBuffer and high-resolution performance timers that were disabled after Spectre. Requires COEP: require-corp to complete cross-origin isolation.

Directives

DirectiveDescription
unsafe-noneDefault. No isolation – cross-origin documents can share the browsing context.
same-origin-allow-popupsIsolate from cross-origin documents except popups opened by this page.
same-originFull isolation. Only same-origin documents share the context. Required for SharedArrayBuffer.

Examples

Enable cross-origin isolation
http
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

Related

Specification

HTML Living StandardCross-Origin-Opener-Policy specification →