Introduction

Describe the challenge or problem on the web you are proposing we address.

Cross-Origin-Opener-Policy is used to sever the relationship between popup and openers, to increase security. "restrict-properties" is a proposed value that restricts the relationship instead of completely severing it. It would enable crossOriginIsolated when paired with COEP.

Developers that want their website to be crossOriginIsolated currently need to give up all relationship with popups. This makes it impossible for websites that use SSO, payments or other APIs that function via popups to be crossOriginIsolated. For these websites, we propose a new COOP value, "restrict-properties" that allows communication via postMessage and closed, while enabling crossOriginIsolated.

COOP "restrict-properties" also allows websites to protect themselves against several XS-Leaks (e.g. frame counting) while supporting popups.

Read the complete Explainer.

Note that this is currently implemented in Chrome in an Origin Trial.

Feedback (Choose One)

Please provide all feedback below.

I welcome feedback in this thread, but encourage you to file bugs against the Explainer.