A new HTTP header named Cross-Origin-Opener-Policy has three values:

  • unsafe-none
  • same-origin-allow-popups
  • same-origin

Google's web.dev article about this header explains its effects on other sites (as in, cross-origin sites) that open sites with this header with regards to a separate browsing context group. Scott Helme's blog post goes into greater detail along with other new headers.

I assume that unsafe-none (the default behaviour) exists for backwards-compatibility reasons to preserve the existing behaviour of window.open().

Are there any situations where you'd want to deliberately want your site to have the default behaviour of unsafe-none (either by setting the value explicitly or omitting the header) such that it is not isolated from another site's browsing context group?


You must log in to answer this question.

Browse other questions tagged .