What is the difference between using Cross-Origin-Opener-Policy and rel="noopener noreferrer"?

user_14080974 0
Viewed 260

The Cross-Origin-Opener-Policy header seems to be quite similar to what the rel="noopener noreferrer" attribute does when opening document in a new tab (target="_blank").

When should I use which one? It seems the COOP header is applicable when I link between origins while the rel="noopener noreferrer" attribute (on anchor tags) seems to work on the same origin as well

The COOP header also don't work over HTTP.

Should I use both? They seem to be quite complimentary.

I am a bit confused here

cross-origin-opener-policy window.opener websecurity
1 Answers

As much as I understand:

COOP will allow you to block access to your window object if someone opens your window from their window, while noreferrer / noopener is for when you don't want the windows that you open as child, to have access to your window object.

  • COOP blocks window access when you window is opened as child
  • noreferrer / noopener blocks window access when your window is the parent
user_20546710
Related