Missing Cross-Origin-Opener-Policy (COOP)
The response did not include Cross-Origin-Opener-Policy.
Why it matters
A cross-origin window can keep a handle to this page, which is the setup used in some cross-origin attacks.
What to do
Set Cross-Origin-Opener-Policy to same-origin, or same-origin-allow-popups if you still need OAuth popups.
Reference
Security response headers reduce XSS, clickjacking, and protocol downgrade risk.