Cross-Origin-Opener-Policy header is set

Without Cross-Origin-Opener-Policy, a cross-origin page that your app opens (or that opens your app) can hold a reference to your window object. Spectre-class speculative-execution attacks use cross-origin window references and shared memory to read data across origin boundaries. CWE-1021 (Improper Restriction of Rendered UI Layers / Frame Hijacking) applies. OWASP A05 (Security Misconfiguration) flags missing isolation headers as a configuration gap. The absence of COOP also prevents the browser from enabling SharedArrayBuffer and high-resolution timers, which are required for performant web workers in security-sensitive contexts.

Set Cross-Origin-Opener-Policy in your Next.js headers config. Use same-origin-allow-popups if your app opens OAuth flows or payment windows; use same-origin for maximum isolation.

// next.config.js
module.exports = {
  async headers() {
    return [{
      source: '/(.*)',
      headers: [{
        key: 'Cross-Origin-Opener-Policy',
        value: 'same-origin-allow-popups'
      }]
    }]
  }
}

Verify OAuth popups still function after deploying — same-origin will break popup-based OAuth flows that communicate via window.opener. Switch to same-origin-allow-popups if you hit that issue.