mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 06:06:09 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #31840 -- Added support for Cross-Origin Opener Policy header.

Browse Source 
Thanks Adam Johnson and Tim Graham for the reviews.

Co-authored-by: Tim Graham <timograham@gmail.com>
This commit is contained in:
bankc
2020-08-26 12:09:19 -04:00
committed by Mariusz Felisiak
parent f6018c1e63
commit db5b75f10f
12 changed files with 175 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
docs/topics/security.txt
View File

@@ -213,6 +213,19 @@ protect the privacy of your users, restricting under which circumstances the
``Referer`` header is set. See :ref:`the referrer policy section of the
security middleware reference <referrer-policy>` for details.
Cross-origin opener policy
==========================
.. versionadded:: 4.0
The cross-origin opener policy (COOP) header allows browsers to isolate a
top-level window from other documents by putting them in a different context
group so that they cannot directly interact with the top-level window. If a
document protected by COOP opens a cross-origin popup window, the popup’s
``window.opener`` property will be ``null``. COOP protects against cross-origin
attacks. See :ref:`the cross-origin opener policy section of the security
middleware reference <cross-origin-opener-policy>` for details.
Session security
================