Your files stay on your device

# COOP checker

Fetches a page's Cross-Origin-Opener-Policy header through the proxy and rules what it isolates the page from across unsafe-none, same-origin-allow-popups and same-origin, flagging unrecognized values.

Press the button to read the headers
Nothing leaves this page until you do. The report grades the Cross-Origin-Opener-Policy header against its three real values, flags values browsers would silently ignore, and names which popup flows break under each policy.

COOP answers one question: when another document opens this page, or this page opens another, do the two windows get to see each other? Without it, the opener keeps window.opener and can navigate your tab after a user has logged in, the classic reverse tabnabbing setup. The safe default is same-origin, with one known exception: OAuth and payment providers need their popup to talk back, so those routes carry same-origin-allow-popups and keep the inbound protection. Two traps are worth checking for. A misspelled value looks configured while browsers silently treat it as unsafe-none, and a Report-Only header rehearses the policy without isolating anything. COOP is per response, so tightening it route by route is a valid rollout.
Options

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/network/cross-origin-opener-policy-checker
Markdown version: https://nutter.tools/network/cross-origin-opener-policy-checker.md
Plain-text version: https://nutter.tools/network/cross-origin-opener-policy-checker.txt
Agent index: https://nutter.tools/llms.txt