Skip to content
ImpactrStart an engagement

HTTP security header

Cross-Origin-Opener-Policy

Cross-Origin-Opener-Policy (COOP) severs the relationship between a document and cross-origin windows that open or are opened by it, preventing cross-origin attacks that rely on shared browsing contexts and enabling cross-origin isolation for powerful features.

Example

Cross-Origin-Opener-Policy: same-origin

Configuration guidance

  • Set same-origin to isolate the browsing context.
  • Required, with COEP, for cross-origin isolation.

Related headers

MDN: COOP

Impactr finds and proves whether flaws like this are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.

Start an engagement
← All security headers