Isolation
Cross-Origin-Opener-Policy (COOP)
Isolate your browsing context.
What it is
Severs the window.opener relationship with cross-origin pages, so a page you open (or that opens you) can't reach back into your window.
Why it matters
Prevents cross-window attacks and is a building block for cross-origin isolation.
Risk without it
Without COOP, a cross-origin popup can retain a reference to your window and probe or navigate it.
Recommended
same-origin
Set it
add_header Cross-Origin-Opener-Policy "same-origin" always;