Skip to content
This repository has been archived by the owner on Mar 14, 2024. It is now read-only.

Commit

Permalink
Correct description of COOP unsafe-none (#3185)
Browse files Browse the repository at this point in the history
Contrary to the current explanation, when an opener specifies a COOP of
`same-origin-allow-popups` and the opened resource specifies
`unsafe-none`, then the two documents *will* share the same browsing
context group.

This is supported by the explanation of `same-origin-allow-popups` which
precedes this section:

> A top-level document with `same-origin-allow-popups` retains
references to > any of its popups which either don't set COOP or which
opt out of isolation > by setting a COOP of `unsafe-none`.

It is also supported by the proposed specification text [1] which reads:

> To check if a response requires a browsing context group switch ,
> given a browsing context browsingContext , an origin responseOrigin
> and a cross-origin opener policy responseCOOP , run the followign
> steps:
>
> [...]
>
> 6. If all of the following are true:
>
>    - isInitialAboutBlank
>    - activeDocumentCOOP is " same-origin-allow-popups ".
>    - responseCOOP is " unsafe-none ".
>
>    then return false.

Update the explanation to only include the relevant condition (that is:
a COOP of `same-origin`).

[1] whatwg/html#5334
  • Loading branch information
jugglinmike authored Jun 10, 2020
1 parent bf951ef commit c3b4ee0
Showing 1 changed file with 1 addition and 2 deletions.
3 changes: 1 addition & 2 deletions src/site/content/en/blog/why-coop-coep/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -217,8 +217,7 @@ Cross-Origin-Opener-Policy: unsafe-none
```

`unsafe-none` is the default and allows the document to be added to its opener's
browsing context group unless the opener itself has a COOP of `same-origin` or
`same-origin-allow-popups`.
browsing context group unless the opener itself has a COOP of `same-origin`.

{% Aside %}
The
Expand Down

0 comments on commit c3b4ee0

Please sign in to comment.