Web Security · Senior · Question 22 of 75

What does `Cross-Origin-Opener-Policy: same-origin` protect against?

1Cookies being sent cross-site
✓Correct answer: Cross-origin windows opened by or opening your page keep a reference to it, enabling attacks like tabnabbing and XS-Leaks
3Scripts from other origins being loaded

Explanation

With COOP the browsing context group is split, so window.opener becomes null across origins.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.