devkult_
tools29converters34
home/headers/cross-origin-opener-policy

Cross-Origin-Opener-Policy

response headersecurity

Isolates your page from cross-origin windows that open it or that it opens.

When one page opens another with window.open, the two normally keep references to each other. COOP set to same-origin cuts that link for cross-origin windows, which protects against attacks that probe or navigate your window. Together with Cross-Origin-Embedder-Policy it enables cross-origin isolation, which unlocks SharedArrayBuffer and high-resolution timers.

Syntax

Cross-Origin-Opener-Policy: unsafe-none | same-origin-allow-popups | same-origin

Defined in HTML Standard — Cross-origin opener policies.

Values

unsafe-nonethe default: no isolation
same-origin-allow-popupsisolate from cross-origin openers, but keep references to popups this page opens
same-originisolate from all cross-origin windows

Examples

Cross-Origin-Opener-Policy: same-origin

full isolation from cross-origin windows

Cross-Origin-Opener-Policy: same-origin-allow-popups

keeps sign-in and payment popups working

Good to know

  • same-origin breaks popups that report back through window.opener, such as many OAuth and payment flows — use same-origin-allow-popups on the page that opens them.
  • crossOriginIsolated requires both COOP same-origin and Cross-Origin-Embedder-Policy: require-corp (or credentialless).

Further reading: Security headers checklist · Security headers generator

How to set Cross-Origin-Opener-Policy

Express
res.set("Cross-Origin-Opener-Policy", "same-origin");
Next.js (next.config.js)
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Cross-Origin-Opener-Policy", value: "same-origin" }],
      },
    ];
  },
};
nginx
add_header Cross-Origin-Opener-Policy "same-origin" always;
Apache (.htaccess)
Header always set Cross-Origin-Opener-Policy "same-origin"

Check it

Fetch only the response headers and filter for Cross-Origin-Opener-Policy. In the browser, it's under Response Headers in DevTools → Network.

curl -sI https://example.com/ | grep -i '^cross-origin-opener-policy:'

To compare response headers across many URLs at once, use the HTTP Status Checker.

Frequently asked questions

Why did my login popup stop working?

With COOP same-origin, the popup loses its window.opener reference and can't pass the result back. Use same-origin-allow-popups on the page that opens it.

Related headers