[HTTP Header] Cross-Origin-Opener-Policy

[Malvoz]

The Cross-Origin-Opener-Policy (COOP) header prevents third-parties from opening/controlling a window.

Explainers:
https://docs.google.com/document/d/1eQEdjHDaJHJ5SFyRKjcqohS7x8XSpF8xmajXimAKcHc
https://docs.google.com/document/d/1Ey3MXcLzwR1T7aarkpBXEwP7jKdd2NvQdgYvF8_8scI

Initial definition:
https://gist.github.com/annevk/6f2dd8c79c77123f39797f6bdac43f3e

Google I/O 2019 explainer video:
https://www.youtube.com/watch?v=DDtM9caQ97I&t=2264

Chrome status:
https://www.chromestatus.com/feature/5432089535053824

---

Edit:
This header was implemented in Safari 12 and renamed from Cross-Origin-Options to Cross-Origin-Window-Policy but support was dropped in release note 67.

This header was also at some point proposed as Cross-Origin-Isolate.

I mention name changes mainly because we should preferably include those as keywords so developers can find the latest version of the header if they stumble upon old documentation.

[cmthornton]

https://bugzilla.mozilla.org/show_bug.cgi?id=1521808

[empijei]

https://bugs.chromium.org/p/chromium/issues/detail?id=922191

[valtlai]

The Cross-Origin-Opener-Policy header is now implemented in Firefox 67.

[Malvoz]

Available at https://caniuse.com/mdn-http_headers_cross-origin-opener-policy.