Safety
COOP same-origin-allow-popups vs same-origin
August 27, 2022
COOP same-origin-allow-popups vs same-origin is whether a document you open with window.open() may stay in the same browsing context group: same-origin severs most opener ties, while same-origin-allow-popups is the checkout and OAuth compromise that can keep a reference to a COOP-less popup. unsafe-none is the historical default and opts out. RoastMyOpsec's free header list is CSP, HSTS, framing, Referrer-Policy, nosniff, and Permissions-Policy — missing COOP is not an F on a brochure origin.
The practical difference
COOP is about browsing context groups and window.opener, not about who may iframe you. Framing stays CSP frame-ancestors / X-Frame-Options. Cross-origin isolation for SharedArrayBuffer-class APIs still needs COOP same-origin plus COEP, which is why tag-heavy marketing pages should not copy a 'maximum isolation' snippet.
same-origin-allow-popups exists because payment and login popups often live on another origin with no COOP. same-origin will put those popups in a new group so opener looks closed. Test the real window.open path in staging before you tighten. noopener-allow-popups is a newer, even more isolating value for same-origin apps that must not script each other via open().
How to choose based on what you shipped
Static brochure, blog, docs with no window.open: try COOP same-origin after you confirm no support widget opens a named window it must script. App or checkout that opens Stripe, PayPal, or an IdP popup: same-origin-allow-popups until that flow is a redirect instead of a popup.
Do not set COEP require-corp on www just because you set COOP. Do not treat COOP as clickjacking defense.
| Option | When it wins | Watch-out | Takeaway |
|---|---|---|---|
| same-origin | No popup scripting; you want opener severed | OAuth or pay window.open looks closed | Tighter default once popups are gone or are redirects |
| same-origin-allow-popups | You still window.open a COOP-less payment or IdP page | Leaving it forever after you moved to redirects | The usual public-app compromise |
| unsafe-none | Legacy opt-out while you inventory popups | Treating it as 'we are isolated' | Historical default; not a security win |
| COEP require-corp | You truly need cross-origin isolation and control every asset | Fonts, GTM, and embeds without CORP/CORS | Not a COOP substitute; not a brochure default |
When same-origin-allow-popups still wins
allow-popups still wins for any origin that opens a trusted cross-origin window and must keep opener until that child sets its own COOP. same-origin still wins on locked-down app shells and on marketing HTML that never calls window.open.
If the popup is only a new tab the user interacts with alone, you may not need opener at all — use rel=noopener on navigations and test. Framing headers remain mandatory either way.
Common mistakes
The first mistake is COOP same-origin the night before a popup checkout and a silent payment failure.
The second mistake is COOP as a replacement for frame-ancestors.
The third mistake is assuming a clean RoastMyOpsec header pack graded COOP.
What a URL roast can prove
RoastMyOpsec does not score Cross-Origin-Opener-Policy or COEP. A clean free header result means CSP quality signals, HSTS, framing, Referrer-Policy, nosniff, and Permissions-Policy were present on that HTML response. TLS is HTTPS scheme, cookies are Secure/HttpOnly/SameSite on session-like names, plus path and JS-secret checks. Missing COOP is not a fail. The scan does not open payment popups, does not score GPC, does not submit HSTS preload, and does not send exploit payloads. Confirm window.open flows in your own staging.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Should a marketing site use COOP same-origin or allow-popups?
- If you never window.open a partner, same-origin is the tighter default after a staging pass. If checkout or login still opens a window, use same-origin-allow-popups until that flow is a top-level redirect.
- Does RoastMyOpsec grade COOP?
- No. The free header checklist does not include COOP or COEP. Framing is still CSP frame-ancestors or X-Frame-Options.
- Does allow-popups weaken clickjacking protection?
- No. COOP is not a framing control. Keep frame-ancestors (and XFO) either way.