"The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents."

In a situation where www.attacker.com opens www.tagetwebsite.com or www.attacker.com embeds a iframe with www.tagetwebsite.com

I imagine SOP already take care of the restriction, since they have different origins.. violators shouldn't be able to access separate origin content even if attacker is the top level document. why is COOP is needed on top of this? Thank you!

  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
    – Community Bot
    Commented Dec 14, 2021 at 3:42

1 Answer 1


The Same Origin Policy (SOP) isolates origins at the logical level and restricts cross-origin interactions. Such isolation can be leaky though, i.e. even if direct cross-origin access is not possible due to SOP there can be side channels like timing which still allow cross-origin information gain - see XSLeaks for more.

COOP allows a site to harden such isolation by placing different origins in differing browsing context groups - which often means different processes at the OS level which means harder memory isolation, independent scheduling etc. This costs resources though and might also disallow some intended cross-origin interactions, thus the header is optional.

For deeper explanation I recommend A Simple Guide to COOP, COEP, CORP, and CORS and even deeper COOP and COEP explained.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .