Protect Your Visualforce Pages with Cross-Origin Opener Policy (COOP)

COOP helps to shield your Visualforce pages from cross-site scripting (XSS), a type of security vulnerability. With XSS, an attacker includes malicious code in a client-side script in a legitimate web page or web application. When a user visits the page or application, the web page or application delivers the malicious script to the user’s browser.

With COOP, each top-level custom Visualforce page opens in a new browsing context group. Browser content that your Visualforce page opens within an iframe can access the parent page. However, processes that attempt to open your page in a new tab or pop-up window can’t access the page for potential cross-origin attacks.

Note To preserve your users’ access to required content, we recommend that you review the expected behavior and test COOP in a sandbox before you enable this feature in production.

Browser access checks use the headers for both your Visualforce page and the external sites that you access from your page. The combination of Cross-Origin Opener Policy (COOP) and Cross-Origin Embedder Policy (COEP) headers determines whether the Visualforce page and external sites can interact. To learn more about COOP and COEP, we recommend these topics on MDN Web Docs: Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy.