product · inferred from evidence
same-origin
A value for the Cross-Origin-Opener-Policy header.
- PayPal button click opens login overlay plus an empty popup window
The root cause is the `Cross-Origin-Opener-Policy` response header: if your site sends `same-origin`, the PayPal SDK detects it cant open popups and falls back to an iframe overlay, but the popup opens anyway, empty, on top of the overlay.