demo · v131
full COOP matrix: what each value gives you
There are now five distinct COOP values. Each makes different trade-offs across opener semantics, isolation, cross-origin embedded contexts and what popups inherit. This matrix is the cheatsheet — find the row that matches your security requirements and see which use cases still work.
works
partial
blocked / undefined
| COOP value | opens cross-origin popup | popup gets opener | postMessage to opener | side-channel isolation | SharedArrayBuffer / crossOriginIsolated |
|---|---|---|---|---|---|
| unsafe-none | yes | yes | yes | no | no |
| same-origin-allow-popups | yes | yes | yes | partial | no |
| noopener-allow-popups (v131) | yes | no (severed) | no | yes | no |
| same-origin | cross-origin popups severed | no | no | yes | no |
| same-origin + COEP | cross-origin popups severed | no | no | yes | yes |
picking the right value
- If you ship OAuth popups but don't need cross-origin isolation:
noopener-allow-popupsis the new safe default. - If you need SharedArrayBuffer:
same-origin+ COEPrequire-corp. - If you're a marketing page:
same-origin-allow-popupsis the long-time pragmatic pick. - If you embed cross-origin auth iframes that need opener: leave on
unsafe-none(accept the risk).
see also
scenario focus
Select a scenario to focus its rendered example and summary.