Cross-Origin-Opener-Policy (COOP)
Isolates your top-level browsing context from other origins, preventing cross-origin window tampering and Spectre side-channel attacks.
same-originProduction Server Implementation
add_header Cross-Origin-Opener-Policy "same-origin" always;Directives & Syntax Breakdown
Completely isolates the window context. Cross-origin documents opened in new windows cannot access window.opener.
Retains opener references for popups opened by this document.
Common Security Hazards & Pitfalls
- •Required together with Cross-Origin-Embedder-Policy (COEP) to enable SharedArrayBuffer and high-resolution performance timers.
Cross-Origin-Opener-Policy (COOP) - Questions & Answers
Common implementation questions, browser enforcement rules, and debugging.
It shields against cross-origin attacks such as XS-Leaks and Spectre by ensuring your web application process is completely isolated in memory.
Related HTTP Headers
Browse All HeadersRestricts where scripts, images, styles, and frames can be loaded from, protecting websites from Cross-Site Scripting (XSS) and data injection attacks.
Forces modern web browsers to communicate exclusively over encrypted HTTPS connections, preventing SSL stripping and man-in-the-middle (MITM) attacks.
Indicates whether a browser should be allowed to render a page inside an <iframe>, <frame>, or <object>, protecting users against clickjacking attacks.
Prevents the browser from MIME-sniffing a response away from the declared Content-Type header, mitigating drive-by malware and MIME confusion attacks.
Controls how much referrer information (URL path and query parameters) is included when navigating away or loading external assets.
Allows site owners to selectively restrict browser hardware features, sensors, APIs, and privacy-invasive tracking mechanisms.