Cross-Origin-Opener-Policy Header: Syntax and Examples

How Cross-Origin-Opener-Policy works

With same-origin, a cross-origin popup or opener gets no window.opener reference to your page, which blocks a class of cross-window attacks and is one of the two headers needed for cross-origin isolation (SharedArrayBuffer, precise timers). It can break OAuth and payment popups that talk back through window.opener; same-origin-allow-popups keeps those working.

Directives

Value	Meaning
`unsafe-none`	The default: no isolation.
`same-origin-allow-popups`	Isolated from openers, but popups you open keep a reference to you.
`same-origin`	Full isolation from cross-origin windows.

Examples

Cross-origin isolation (with COEP)

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

Check it

curl -sI https://example.com | grep -i '^cross-origin-opener-policy:'

Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.

Related headers

Cross-Origin-Embedder-Policy: requires every cross-origin resource a page loads to opt in to being embedded (COEP).
Cross-Origin-Resource-Policy: says which sites may load this resource with no-cors requests such as <img> and <script> (CORP).
X-Frame-Options: controls whether the page may be shown in a frame on another site, to prevent clickjacking.

More security headers

Content-Security-Policy , Strict-Transport-Security , X-Content-Type-Options , Referrer-Policy , Permissions-Policy .

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does the Cross-Origin-Opener-Policy header do?

The Cross-Origin-Opener-Policy response header separates your page from cross-origin windows it opens or is opened by (COOP). With same-origin, a cross-origin popup or opener gets no window.opener reference to your page, which blocks a class of cross-window attacks and is one of the two headers needed for cross-origin isolation (SharedArrayBuffer, precise timers). It can break OAuth and payment popups that talk back through window.opener; same-origin-allow-popups keeps those working.

How do I see the Cross-Origin-Opener-Policy header?

Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.