[ZAP Security] Cross-Origin-Opener-Policy Header Missing or Invalid

[github-actions]

Cross-Origin-Opener-Policy Header Missing or Invalid

Risk Level: Low

Confidence: 2

Description

Cross-Origin-Opener-Policy header is a response header that allows a site to control if others included documents share the same browsing context. Sharing the same browsing context with untrusted documents might lead to data leak.

Solution

Ensure that the application/web server sets the Cross-Origin-Opener-Policy header appropriately, and that it sets the Cross-Origin-Opener-Policy header to 'same-origin' for documents.

'same-origin-allow-popups' is considered as less secured and should be avoided.

If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Opener-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-opener-policy).

Reference

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy

CWE ID: 693

WASC ID: 14

Example Instance

URL: https://localhost:44322

Method: GET

Parameter: Cross-Origin-Opener-Policy

---

This issue was automatically created from an OWASP ZAP security scan.
Alert detected on: 2026-02-18
Plugin ID: 90004

Scan Metadata

• Branch: main
• Template Source: NuGet.org
• Clean Template Version: 7.0.5
• Umbraco CMS Version: 17.1.0