coop-middleware

HTTP cross-origin opener policy(COOP) middleware.

Compliant with HTML Living Standard, 7.1.3 Cross-origin opener policies.

Middleware

For a definition of Universal HTTP middleware, see the http-middleware project.

Usage

Middleware adds the Cross-Origin-Opener-Policy header to the response.

import {
  coop,
  type Handler,
} from "https://deno.land/x/coop_middleware@$VERSION/mod.ts";
import { assert } from "https://deno.land/std/testing/asserts.ts";

declare const request: Request;
declare const handler: Handler;

const middleware = coop();
const response = await middleware(request, handler);

assert(response.headers.has("cross-origin-opener-policy"));

yield:

Cross-Origin-Opener-Policy: same-origin

Options

The middleware factory accepts the following fields:

Name	Type	Default	Description
policy	"unsafe-none" | "same-origin-allow-popups" | "same-origin"	"same-origin"	Embedder policy value.
reportTo	string	-	Reporting endpoint name.
reportOnly	boolean	false	Whether the header is report-only or not.

policy

If specified, change the cross-origin opener policy value.

import { coop } from "https://deno.land/x/coop_middleware@$VERSION/middleware.ts";

const middleware = coop({ policy: "same-origin-allow-popups" });

yield:

Cross-Origin-Opener-Policy: same-origin-allow-popups

reportTo

If specified, adds a report-to param to the output.

import { coop } from "https://deno.land/x/coop_middleware@$VERSION/middleware.ts";

const middleware = coop({ reportTo: "default" });

yield:

Cross-Origin-Opener-Policy: same-origin;report-to=default

reportOnly

Depending on the value, the header will be:

Value	Field name
true	Cross-Origin-Opener-Policy-Report-Only
false	Cross-Origin-Opener-Policy

import { coop } from "https://deno.land/x/coop_middleware@$VERSION/middleware.ts";

const middleware = coop({ reportOnly: true });

yield:

Cross-Origin-Opener-Policy-Report-Only: same-origin

Throwing error

If serialization of opener policy fails, it may throw TypeError.

The following cases are failures:

• If reportTo field is an invalid <sf-token> syntax

import { coop } from "https://deno.land/x/coop_middleware@$VERSION/middleware.ts";
import { assertThrows } from "https://deno.land/std/testing/asserts.ts";

assertThrows(() => coop({ reportTo: "<invalid>" }));

Conditions

Middleware will execute if all of the following conditions are met:

• Response does not include Cross-Origin-Opener-Policy header
• Response does not include Cross-Origin-Opener-Policy-Report-Only header

Effects

Middleware may make changes to the following elements of the HTTP message.

• HTTP Headers
  • Cross-Origin-Opener-Policy
  • Cross-Origin-Opener-Policy-Report-Only

API

All APIs can be found in the deno doc.

License

Copyright © 2023-present httpland.

Released under the MIT license