A new HTTP header named
Cross-Origin-Opener-Policy has three values:
Google's web.dev article about this header explains its effects on other sites (as in, cross-origin sites) that open sites with this header with regards to a separate browsing context group. Scott Helme's blog post goes into greater detail along with other new headers.
I assume that
unsafe-none (the default behaviour) exists for backwards-compatibility reasons to preserve the existing behaviour of
Are there any situations where you'd want to deliberately want your site to have the default behaviour of
unsafe-none (either by setting the value explicitly or omitting the header) such that it is not isolated from another site's browsing context group?