Cross-Origin-Opener-Policy
ResponseActiveCross-Origin-Opener-Policy (COOP) isolates the browsing context from cross-origin documents. Setting it to 'same-origin' prevents other origins from getting a reference to the window (window.opener), protecting against cross-origin information leakage. COOP is required alongside COEP to enable SharedArrayBuffer and high-resolution timers (Spectre mitigation).
Description
COOP controls which documents share a browsing context group. 'same-origin' means only same-origin documents can share the group – cross-origin documents open in a new group with no window.opener reference. This is required to enable cross-origin isolation, which unlocks SharedArrayBuffer and high-resolution performance timers that were disabled after Spectre. Requires COEP: require-corp to complete cross-origin isolation.
Directives
| Directive | Description |
|---|---|
| unsafe-none | Default. No isolation – cross-origin documents can share the browsing context. |
| same-origin-allow-popups | Isolate from cross-origin documents except popups opened by this page. |
| same-origin | Full isolation. Only same-origin documents share the context. Required for SharedArrayBuffer. |
Examples
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp