What the cross-origin headers do

How it works

When a page opens a new window, or is opened from one, the two keep a link to each other. Through window.opener, another site can for example redirect your window to a different address or draw conclusions from how it behaves. Pages linked like this also often run in the same browser process, where attacks such as Spectre can read the other page's data through shared memory.

Three headers deal with this:

• Cross-Origin-Opener-Policy (COOP) separates your window from windows of other sites. With same-origin the browser puts your page into a group of its own; foreign windows lose access.
• Cross-Origin-Embedder-Policy (COEP) makes your page load only foreign content that explicitly allows it.
• Cross-Origin-Resource-Policy (CORP) is that permission from the other side: a file says whether it may be loaded only by the same origin (same-origin), the same site (same-site) or by anyone (cross-origin).

Together, COOP and COEP make a page “cross-origin isolated”. Only then do browsers unlock features such as SharedArrayBuffer.

What matters

• COOP is the easiest step. It gives most of the protection and only affects windows, not loading content. The report treats its absence as a hint, not an error.
• Check pop-ups. Logins through a pop-up (OAuth, for example) or payment windows that report back to your page need the window link. For them there is same-origin-allow-popups: your page then keeps the link to windows it opens itself.
• COEP only with care. With require-corp the browser blocks every foreign image, script or video that sends no permission. You only need it if your page wants the isolated features.

How to set it up

The recommended header:

Cross-Origin-Opener-Policy: same-origin

Check first that logins through pop-ups keep working; if not, use same-origin-allow-popups. The header is set in the web server or the application, by you or your agency.

add_header Cross-Origin-Opener-Policy "same-origin" always;

Header always set Cross-Origin-Opener-Policy "same-origin"

COEP and CORP are a matter for developers when an application really needs them.