Cross-Origin Opener Policy (COOP)
Was ist Cross-Origin Opener Policy (COOP)?
Cross-Origin Opener Policy (COOP)An HTTP response header that lets a document opt into a process-isolated browsing context group, preventing cross-origin windows from inspecting or manipulating it via `window.opener` and friends.
Cross-Origin Opener Policy is a browser security header (`Cross-Origin-Opener-Policy`) that controls whether a top-level document shares a browsing-context group with cross-origin openers and pop-ups. Values are `unsafe-none` (the default, fully shared), `same-origin-allow-popups` (isolates the document but lets it open cross-origin pop-ups), and `same-origin` (full isolation). With `same-origin`, the browser severs the `window.opener` reference for cross-origin navigations, preventing attacks such as XS-Leaks that rely on probing properties of a sibling tab. COOP is also a precondition for the cross-origin isolated state, which together with COEP (`Cross-Origin-Embedder-Policy: require-corp`) unlocks `SharedArrayBuffer`, high-resolution timers, and other features that were restricted in the wake of Spectre. Most security-sensitive sites set `Cross-Origin-Opener-Policy: same-origin` and `Cross-Origin-Embedder-Policy: require-corp` together.
● Beispiele
- 01
An authenticated dashboard sets `Cross-Origin-Opener-Policy: same-origin` so that any window opened from an attacker site cannot read its `window` object after navigation.
- 02
A WASM-heavy app enables COOP and COEP together to qualify for cross-origin isolation and regain access to `SharedArrayBuffer`.
● Häufige Fragen
Was ist Cross-Origin Opener Policy (COOP)?
An HTTP response header that lets a document opt into a process-isolated browsing context group, preventing cross-origin windows from inspecting or manipulating it via `window.opener` and friends. Es gehört zur Kategorie Anwendungssicherheit der Cybersicherheit.
Was bedeutet Cross-Origin Opener Policy (COOP)?
An HTTP response header that lets a document opt into a process-isolated browsing context group, preventing cross-origin windows from inspecting or manipulating it via `window.opener` and friends.
Wie funktioniert Cross-Origin Opener Policy (COOP)?
Cross-Origin Opener Policy is a browser security header (`Cross-Origin-Opener-Policy`) that controls whether a top-level document shares a browsing-context group with cross-origin openers and pop-ups. Values are `unsafe-none` (the default, fully shared), `same-origin-allow-popups` (isolates the document but lets it open cross-origin pop-ups), and `same-origin` (full isolation). With `same-origin`, the browser severs the `window.opener` reference for cross-origin navigations, preventing attacks such as XS-Leaks that rely on probing properties of a sibling tab. COOP is also a precondition for the cross-origin isolated state, which together with COEP (`Cross-Origin-Embedder-Policy: require-corp`) unlocks `SharedArrayBuffer`, high-resolution timers, and other features that were restricted in the wake of Spectre. Most security-sensitive sites set `Cross-Origin-Opener-Policy: same-origin` and `Cross-Origin-Embedder-Policy: require-corp` together.
Wie schützt man sich gegen Cross-Origin Opener Policy (COOP)?
Schutzmaßnahmen gegen Cross-Origin Opener Policy (COOP) kombinieren typischerweise technische Kontrollen und operative Praktiken, wie in der Definition oben beschrieben.
Welche anderen Bezeichnungen gibt es für Cross-Origin Opener Policy (COOP)?
Übliche alternative Bezeichnungen: COOP.
● Verwandte Begriffe
- appsec№ 262
Cross-Origin Embedder Policy (COEP)
An HTTP response header that forces every cross-origin subresource a document loads to explicitly opt in via CORS or CORP, completing the cross-origin isolation prerequisites alongside COOP.
- appsec№ 237
Content Security Policy (CSP)
HTTP-Antwort-Header, der dem Browser mitteilt, welche Quellen für Skripte, Styles, Frames und andere Inhalte erlaubt sind, und so XSS- und Datendiebstahlangriffe begrenzt.
- appsec№ 552
HTTP-Sicherheitsheader
Antwort-Header, die den Browser zu defensivem Verhalten anweisen: HTTPS-Pflicht, Framing-Beschränkungen, Inhaltsrichtlinien und Referer-Kontrolle.
- appsec№ 1071
Same-Origin Policy (SOP)
Browser-Sicherheitsregel, die einschrankt, wie ein Dokument oder Skript einer Origin mit Ressourcen einer anderen Origin interagieren darf.
- appsec№ 1164
Site Isolation
Chromium-Sicherheitsarchitektur, die Dokumente unterschiedlicher Sites in separate Betriebssystemprozesse legt, sodass ein kompromittierter Renderer keine fremden Daten lesen kann.
- vulnerabilities№ 1192
Spectre
Familie microarchitektonischer Angriffe, die spekulative Ausführung von CPUs missbrauchen, um Daten über Cache-Seitenkanäle über Sicherheitsgrenzen hinweg zu leaken.
● Siehe auch
- № 911Permissions-Policy