During the web platform security review: @camillelamy & @arturjanc were wondering if there was some security consideration written about:

• Cross-Origin-Opener-Policy: same-origin navigation, but incompatible COOP policies.
• Redirect: A cross-origin navigation redirecting back to a same-origin one. Potential "Confused deputy attack" kind of issues maybe?

In both cases, after thinking about it for a while, I personally don't see any strong evidence any of this can be used by an attacker. Maybe @arturjanc had some ideas (?)

anyway, it would be nice to add some notes on the types of attacks being considered with regards to COOP and redirects, and explain why we think the currently defined behavior looks safe.