CODEWITHSUNDEEP
websecuritywindow.openercross-origin-opener-policy
Joe Markov
Joe Markov

Reputation: 387

What is the difference between using Cross-Origin-Opener-Policy and rel="noopener noreferrer"?

The Cross-Origin-Opener-Policy header seems to be quite similar to what the rel="noopener noreferrer" attribute does when opening document in a new tab (target="_blank").

When should I use which one? It seems the COOP header is applicable when I link between origins while the rel="noopener noreferrer" attribute (on anchor tags) seems to work on the same origin as well.

The COOP header also doesn't work over HTTP.

Should I use both? They seem to be quite complimentary.

I am a bit confused here.

Upvotes: 5

Views: 1391

Answers (1)

gaurav5430
gaurav5430

Reputation: 13892

As much as I understand:

COOP will allow you to block access to your window object if someone opens your window from their window, while noreferrer / noopener is for when you don't want the windows that you open as child, to have access to your window object.

  • COOP blocks window access when you window is opened as child
  • noreferrer / noopener blocks window access when your window is the parent

Upvotes: 1

Related Questions