Cross-Origin-Opener-Policy (COOP) Explained
Cross-Origin-Opener-Policy isolates your browsing context from cross-origin popups. Learn same-origin vs same-origin-allow-popups and when COOP helps.
Cross-Origin-Opener-Policy (COOP) is a response header that controls whether your document shares a browsing context group with cross-origin documents you open. With a strict policy, cross-origin popups no longer retain a scripting relationship via window.opener, which reduces a class of cross-origin attacks and enables stronger isolation features.
PatchPings sends Cross-Origin-Opener-Policy: same-origin-allow-popups site-wide so pages gain isolation benefits while OAuth and sign-in popups remain usable. This guide explains the common values and how to verify the header.
Common COOP values
- `unsafe-none` - default legacy behaviour; opener relationships stay intact.
- `same-origin` - isolate unless the other document is same-origin and also agrees.
- `same-origin-allow-popups` - isolate from cross-origin openers, but allow this document to retain references to popups it opens (important for many OAuth flows).
Cross-Origin-Opener-Policy: same-origin-allow-popups
COOP is not COEP or CORP
People often confuse three related headers. COOP isolates browsing context groups. Cross-Origin-Embedder-Policy (COEP) and Cross-Origin-Resource-Policy (CORP) govern embedded cross-origin resources and are required for some advanced APIs (such as certain SharedArrayBuffer scenarios). You can ship COOP without COEP. PatchPings does exactly that: COOP on, no COEP/CORP requirement for the marketing site.
If you choose same-origin and a Google or GitHub popup login breaks, try same-origin-allow-popups before abandoning COOP entirely.
When to enable COOP
- 1Inventory flows that use
window.openor federated login popups. - 2Deploy
same-origin-allow-popupson HTML responses first. - 3Regression-test auth, payment, and support widgets.
- 4Tighten to
same-originonly if you do not need cross-origin popup references.
How to check the live header
Inspect response headers in DevTools or run a security headers check via a PatchPings scan. Confirm the value on document navigations, not only on API JSON. CDN layers should forward the header unchanged.
COOP is a quiet hardening win. Prefer same-origin-allow-popups when OAuth matters, document the choice next to your other HTTP security headers, and re-scan after every proxy change.
