Your files stay on your device

COOP checker

Fetches a page's Cross-Origin-Opener-Policy header through the proxy and rules what it isolates the page from across unsafe-none, same-origin-allow-popups and same-origin, flagging unrecognized values.

Press the button to read the headers

Nothing leaves this page until you do. The report grades the Cross-Origin-Opener-Policy header against its three real values, flags values browsers would silently ignore, and names which popup flows break under each policy.

COOP answers one question: when another document opens this page, or this page opens another, do the two windows get to see each other? Without it, the opener keeps window.opener and can navigate your tab after a user has logged in, the classic reverse tabnabbing setup. The safe default is same-origin, with one known exception: OAuth and payment providers need their popup to talk back, so those routes carry same-origin-allow-popups and keep the inbound protection. Two traps are worth checking for. A misspelled value looks configured while browsers silently treat it as unsafe-none, and a Report-Only header rehearses the policy without isolating anything. COOP is per response, so tightening it route by route is a valid rollout.

Was this tool useful?