From db5b75f10fe211af9fab9094f937436760db8488 Mon Sep 17 00:00:00 2001 From: bankc Date: Wed, 26 Aug 2020 12:09:19 -0400 Subject: Fixed #31840 -- Added support for Cross-Origin Opener Policy header. Thanks Adam Johnson and Tim Graham for the reviews. Co-authored-by: Tim Graham --- docs/topics/security.txt | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'docs/topics') diff --git a/docs/topics/security.txt b/docs/topics/security.txt index fe692cad2a..5d60805a26 100644 --- a/docs/topics/security.txt +++ b/docs/topics/security.txt @@ -213,6 +213,19 @@ protect the privacy of your users, restricting under which circumstances the ``Referer`` header is set. See :ref:`the referrer policy section of the security middleware reference ` for details. +Cross-origin opener policy +========================== + +.. versionadded:: 4.0 + +The cross-origin opener policy (COOP) header allows browsers to isolate a +top-level window from other documents by putting them in a different context +group so that they cannot directly interact with the top-level window. If a +document protected by COOP opens a cross-origin popup window, the popup’s +``window.opener`` property will be ``null``. COOP protects against cross-origin +attacks. See :ref:`the cross-origin opener policy section of the security +middleware reference ` for details. + Session security ================ -- cgit v1.3