How to add the Cross-Origin-Opener-Policy header in Nginx

Nginx configuration (nginx server block)

add_header Cross-Origin-Opener-Policy "same-origin" always;

Place it in the server or location block, then run nginx -t and reload. add_header in a location block replaces headers set at server level, so repeat them where needed. The always flag sends the header on error responses too.

Before you deploy

same-origin can break OAuth or payment pop-ups that rely on window.opener. Use same-origin-allow-popups in that case.

Verify it works

curl -sI https://your-site.com | grep -i cross-origin-opener-policy

Or run a free Korrali Web scan to check this and every other security header at once.

Other headers in Nginx

• Strict-Transport-Security in Nginx
• Content-Security-Policy in Nginx
• X-Frame-Options in Nginx
• X-Content-Type-Options in Nginx
• Referrer-Policy in Nginx
• Permissions-Policy in Nginx
• Cross-Origin-Resource-Policy in Nginx