DNS, email record, SSL and header checks

Esc

Cross Origin Opener Policy (COOP) Checker

Check a page's Cross-Origin-Opener-Policy, see whether it is cross-origin isolated and generate the header lines.

How this check works: our server sends one ordinary GET request per redirect step (at most 10) to the public address you enter, the same request a browser would make, and shows you a short summary — status codes, selected response headers and, for robots.txt, the file itself (up to 64 KB). It never sends data on your behalf, never contacts private or internal addresses, and does not log or store what you type; results are cached for 10 minutes and each visitor can run 10 checks per minute.

Open on Domain Check Desk

Embed

Embed this tool

Copy this code into your website, blog or class page. The tool runs inside your page.

Please keep the credit link below the tool.

Get notified about new checks and updates

We send a short email only when we add a new tool or make a major change to one — no newsletter, no ads, never shared. To unsubscribe, email support@360jiance.com with the word “unsubscribe” and we delete your address. What we store.

The Cross-Origin-Opener-Policy checker reads the COOP header of a web page and tells you what that policy does to the page’s windows and pop-ups. You can paste response headers into the box, or type a web address and press Check headers to fetch them from this site’s server. The result shows the verdict, the raw COOP and COEP values, whether the page is cross-origin isolated, and warnings for common mistakes. The tool also writes header lines for several common servers, so you can set the policy yourself. Pasted headers are checked in your browser, and an example set of headers is already in the box so you can see a full result before testing your own page.
Cross origin opener policy example

How to use the Cross-Origin-Opener-Policy checker

  1. Choose one of two ways to load headers:
    • To check headers you already have, paste them into the Response headers box.
    • To check a live page, type its address into the Web address (URL) box.
  2. If you typed a web address, press Check headers. The tool fetches the response headers from this site’s server.
  3. Read the What this policy does row first. It gives the verdict for the page’s COOP value.
  4. Check the Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy rows to see the exact values the page sent.
  5. Look at the Cross-origin isolated row. It shows Yes or No.
  6. Read any warnings. They cover several values, a quoted value, an unknown token, report-only headers, a missing policy, and a report-to endpoint name.
  7. To set the policy, use the generator fields below the headers box. Choose a value under Generator: opener policy, choose a value under Generator: Cross-Origin-Embedder-Policy, and pick your server under Generator: server. The tool writes the lines for that server, and they appear in the Generated header lines row.

If you are not sure where to begin, look at the result for the example headers that are in the box when the tool opens. It shows a full set of results, so you can see what each row means before you enter your own headers.

What is Cross-Origin-Opener-Policy

Cross-Origin-Opener-Policy (COOP) is a response header that a server sends with a web page. It controls whether that page stays in the same browsing context group as pages from other origins that it opens, or that open it. Browsers use this to keep one site’s window separate from another site’s window.

The header holds one token, such as same-origin, and may optionally add a report-to="endpoint" parameter. A quoted string such as "same-origin" is not a token, so browsers ignore it. The default value is unsafe-none, which keeps the document in the same group as the page that opened it. The other values are same-origin-allow-popups, same-origin, and noopener-allow-popups.

A Cross-Origin-Opener-Policy-Report-Only header reports what would happen under a policy but changes nothing. It is useful for testing before you enforce a value.

What does same-origin do in COOP

The same-origin value is the one cross-origin isolation is built on. A page with this value is placed in its own browsing context group, and cross-origin pages cannot share that group with it. A pop-up that the page opens must contain same-origin documents that use the same policy. If it does not, the pop-up appears closed.

With same-origin, window.opener becomes empty (null) for cross-origin pop-ups. That cuts the link between the two windows. A page that opens a sign-in or payment window and waits for an answer through that link may stop working. In that case, same-origin-allow-popups is often the better choice, because it keeps the link for pop-ups that have no policy of their own.

Worked examples

InputResult
Cross-Origin-Opener-Policy: same-origin + Cross-Origin-Embedder-Policy: require-corpOwn browsing context group and cross-origin isolated (same-origin plus a compatible COEP)
Cross-Origin-Opener-Policy: same-origin-allow-popupsOwn browsing context group, except that popups this page opens without a policy of their own keep their link to it
Cross-Origin-Opener-Policy: "same-origin"No isolation: shares a browsing context group with the page that opened it (unsafe-none, the default)
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop"No isolation: shares a browsing context group with the page that opened it (unsafe-none, the default)
Server: nginxNo isolation: shares a browsing context group with the page that opened it (unsafe-none, the default)

Calculated by the tool above; open it with the same values to see each step.

Frequently asked questions

How to enable cross-origin isolation?

Set Cross-Origin-Opener-Policy to same-origin and set a Cross-Origin-Embedder-Policy of require-corp or credentialless. Both headers are needed, because COOP alone and COEP alone do not isolate the page. With require-corp, every cross-origin resource must opt in with a Cross-Origin-Resource-Policy or CORS header, so test the page before you ship the lines.

What is same-origin-allow-popups?

It is a COOP value that puts the page in its own browsing context group unless the opener had the same policy and the same origin. Pop-ups that the page opens and that have no policy of their own keep their link to the page. It suits pages that open sign-in or payment windows and need to receive a reply.

Does a Report-Only header block anything?

No. A Cross-Origin-Opener-Policy-Report-Only header only reports what would happen under the policy. It changes nothing about how the page or its pop-ups behave, so it is safe for testing.

Why does the checker say my COOP value is ignored?

The value is probably wrapped in quotation marks, as in "same-origin". The header must contain a bare token, such as same-origin, so browsers ignore quoted strings. The checker also warns about unknown tokens and about several values in one header.

Is noopener-allow-popups a strong security boundary?

Not fully. It always opens pop-ups in their own group, whatever opened them, but it is not a robust boundary between same-origin documents. Use same-origin when you need a stronger separation.

Does the URL check send my headers anywhere?

Pasted headers are checked in your browser. The URL check sends the address you typed to this site’s read-only header check on its own server, which only reads response headers.