v131 · security

noopener-allow-popups COOP value

Some origins can contain different applications with different levels of security requirements. In those cases, it can be beneficial to prevent scripts running in one application from being able to open and script pages of another same-origin application. In such cases, it can be beneficial for a document to ensure its opener cannot script it, even if the

concepts

  1. COOP noopener-allow-popups

    COOP value that severs the opener for the popup but still allows it to be opened. Strong isolation for sites that need popups but don't want bi-directional access.

  2. Live opener test

    Open a popup three ways and read window.opener from inside it — see that COOP overrides rel="opener".

  3. OAuth popup flow tradeoffs

    Three side-by-side OAuth flows under different COOP values. Where each one breaks, why, and the migration recipe.

  4. Full COOP value matrix

    Cheatsheet table: every COOP value × every relevant behaviour. Pick the row that matches your requirements.

why it shipped

Some origins can contain different applications with different levels of security requirements. In those cases, it can be beneficial to prevent scripts running in one application from being able to open and script pages of another same-origin application.

references