fix: allow cross-origin popups to access opener's browser context

cal-itp · Jul 18, 2022 · 6a1a25c · 6a1a25c
1 parent bc63702
commit 6a1a25c
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/benefits/settings.py b/benefits/settings.py
@@ -114,6 +114,9 @@ def _filter_empty(ls):
 
 SECURE_BROWSER_XSS_FILTER = True
 
+# required so that cross-origin pop-ups (like the enrollment overlay) have access to parent window context
+SECURE_CROSS_ORIGIN_OPENER_POLICY = "same-origin-allow-popups"
+
 # the NGINX reverse proxy sits in front of the application in deployed environments
 # SSL terminates before getting to Django, and NGINX adds this header to indicate
 # if the original request was secure or not