Skip to content
iframecheck

Cross-Origin-Opener-Policy

Cross-Origin-Opener-Policy (COOP) is an HTTP response header that decides if a top-level page keeps a link to windows on other origins. When COOP cuts the link, window.opener is null and the two windows cannot reach each other.

HTTP header

Also called COOP

Updated

On this page

How it works

A browsing context group is the set of windows that can reach each other, for example with window.opener. When a page opens a pop-up or the tab goes to a new page, the browser compares the COOP values of the two pages. If they do not match, the browser puts the new page in a new group.

The browser reads COOP only on a top-level page, not on a page in an iframe. It also reads it only in a secure context, such as an HTTPS page. It ignores a value that is not valid.

Values

ValueResult
unsafe-none (default)The page can share its group with any page. There is no isolation.
same-origin-allow-popupsLike same-origin, but pop-ups that the page opens keep their link when they use unsafe-none.
same-originThe page shares its group only with same-origin pages that also send same-origin. Cross-origin isolation needs this value.
noopener-allow-popupsThe page always opens in a new group, even when a same-origin page opens it. Its own pop-ups can keep their link.

Example

HTTP response header
Cross-Origin-Opener-Policy: same-origin-allow-popups

Cross-origin pages that open this page lose their link to it. A pop-up that this page opens, and that sends no COOP header, can still use window.opener.

How to set it

Send the header from the top-level page. Use same-origin for the strongest isolation. Use same-origin-allow-popups when the page opens sign-in or payment pop-ups.

Cross-Origin-Opener-Policy: same-origin

With same-origin, a sign-in pop-up on another origin loses window.opener and cannot send the result back. Use same-origin-allow-popups on pages that open such pop-ups.

Learn more

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.

Test a URLBrowse guides