Cybersecurity glossary
What is Cross-Origin Opener Policy (COOP)?
Learn what Cross-Origin Opener Policy (COOP) is, how it isolates browsing contexts from cross-origin openers, why it pairs with COEP, and how same-origin values reduce XS-Leaks and unlock isolation.
Definition
Cross-Origin Opener Policy (COOP) is an HTTP response header that controls whether a document can share a browsing context group with cross-origin opener windows, helping isolate pages from untrusted openers and enabling cross-origin isolation with COEP.
Why COOP matters
Browser windows are not always as separate as users think. A page that opens another page may retain a window.opener relationship. That relationship has been abused for phishing (opener navigations), information leaks, and other cross-site interactions that sit outside classic cookie theft.
Cross-Origin Opener Policy (COOP) lets a document declare how it participates in browsing context groups with its openers and openees. With an isolating policy such as same-origin, cross-origin openers are severed. That isolation is also one half of the COOP+COEP pair browsers use for cross-origin isolation.
How COOP works
COOP is an HTTP response header on a document. During navigation, the browser compares policies and origins to decide whether the document may join an existing browsing context group or must be moved into a new one.
Document sends COOP
The response includes Cross-Origin-Opener-Policy with a chosen value such as same-origin.
Browser evaluates relationships
Origin and policy compatibility determine whether opener references can remain.
Incompatible openers are detached
Cross-origin opener access is cut when policies require isolation.
Popup and tab assumptions change
Flows that depended on window.opener must use explicit, origin-checked messaging instead.
Pair with COEP for isolation
When COEP is also enforced, the document can enter a cross-origin isolated state.
Powerful APIs become gated safely
Browsers can expose certain features only to isolated contexts under their security model.
Common COOP values
unsafe-none
Permissive default-like behavior. Cross-origin openers may retain relationships unless other policies intervene.
same-origin
Strong isolation. Only same-origin documents share the browsing context group under the policy rules.
same-origin-allow-popups
A compatibility-oriented option that isolates the document while easing some popup use cases.
Security benefits
| Benefit | What improves |
|---|---|
| Opener isolation | Reduces hostile reverse tabnabbing and unexpected opener control from cross-origin pages. |
| XS-Leaks reduction | Limits some cross-window observation primitives tied to shared context relationships. |
| Cross-origin isolation | Together with COEP, satisfies browser requirements for isolated capability access. |
| Clearer trust boundary | Forces explicit postMessage designs instead of implicit cross-origin window coupling. |
Compatibility checklist
- Map OAuth, payment, and helpdesk flows that open cross-origin windows and rely on opener callbacks.
- Replace opener reads/writes with postMessage plus strict event.origin validation where needed.
- Choose same-origin when pursuing isolation; consider same-origin-allow-popups during migration.
- Deploy COEP in tandem if SharedArrayBuffer or other isolated APIs are required.
- Test single sign-on popups, PDF viewers, and partner widgets after enabling COOP.
- Set COOP on the actual HTML document responses, including CDN-cached entry pages.
- Do not assume COOP blocks iframe embedding; configure frame-ancestors separately.
- Monitor support tickets for login-loop regressions after opener detachment.
COOP vs framing defenses
Teams sometimes conflate opener isolation with clickjacking defense. An attacker can still attempt to iframe a page if frame-ancestors allows it, regardless of COOP. Likewise, a page can be free from framing yet still interact with openers without COOP. Use each header for its job.
The practical takeaway
Cross-Origin Opener Policy (COOP) isolates documents from cross-origin window relationships that browsers historically left connected. It hardens opener-based attacks and, with COEP, enables cross-origin isolation.
Adopt COOP when you need that isolation or want stronger window boundaries—but inventory popup-based login and payment flows first so security improvements do not silently break authentication.
Related security terms
Cross-Origin Embedder Policy (COEP)
Companion embedder policy required with COOP for full cross-origin isolation.
Same-Origin Policy (SOP)
Baseline origin boundary that COOP strengthens for window relationships.
Cross-Origin Resource Sharing (CORS)
A different cross-origin mechanism focused on read access to responses, not opener isolation.
Clickjacking
A UI redress threat addressed primarily by framing controls, complementary to opener isolation.
Frequently asked questions
What is COOP in simple terms?
COOP tells the browser whether your page should remain connected to the window that opened it when that opener is cross-origin. Isolating values cut those relationships to reduce cross-window attacks and help enable stronger isolation modes.
What does Cross-Origin-Opener-Policy: same-origin do?
It keeps the document in a browsing context group only with same-origin documents. Cross-origin openers lose direct window references, which blocks many opener-based attacks and is commonly required for cross-origin isolation.
How is COOP different from COEP?
COOP isolates windows and browsing context groups. COEP restricts which cross-origin resources may be embedded. Browsers typically need both for a cross-origin isolated state.
Will COOP break OAuth popups?
It can. Login flows that rely on window.opener communication between cross-origin pages may need redesign using postMessage with strict origin checks, redirects, or same-site architecture changes.
Does COOP replace CSP frame-ancestors?
No. frame-ancestors and X-Frame-Options control embedding/framing. COOP controls opener/browsing-context relationships. Sites often need both classes of defense.
What values can COOP use?
Common values include unsafe-none (default permissive behavior), same-origin-allow-popups, and same-origin. Choose based on isolation needs and popup compatibility.
Why do Spectre mitigations mention COOP?
Cross-origin isolation, achieved with COOP and COEP, helps browsers gate access to high-risk primitives and reduce certain side-channel exposure between origins in the same process relationships.
References
Explore authoritative guidance and frameworks related to cross-origin opener policy (coop).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.