纯JS/HTML实现Google身份验证遇Cross-Origin-Opener-Policy报错求助

我用纯JS和HTML实现Google Identity身份验证，严格遵循官方指南配置，已将网站URL添加至Google认证控制台，但点击登录按钮弹出窗口时，控制台出现以下错误：

client:258 Cross-Origin-Opener-Policy policy would block the window.postMessage call.

我尝试通过经典ASP添加以下头部：

Response.AddHeader "Content-Security-Policy-Report-Only","script-src 'self' 'unsafe-inline' https://accounts.google.com/gsi/client; frame-src https://accounts.google.com/gsi/; connect-src https://accounts.google.com/gsi/;"

参考过相关问答但因对方使用React无法适配。

当前登录按钮实现代码如下（已替换为正确的MY_CLIENT_ID）：

<script src="https://accounts.google.com/gsi/client" async defer></script>
<div id="g_id_onload"  data-client_id="MY_CLIENT_ID"   data-callback="handleCredentialResponse"></div>
<div class="g_id_signin" data-type="standard"></div>

handleCredentialResponse回调可成功接收部分响应数据：

function handleCredentialResponse(response) {
    const responsePayload = decodeJwtResponse(response.access_token);
    console.log("Credential: " + responsePayload.credential);
    console.log("ID: " + responsePayload.sub);
    console.log('Full Name: ' + responsePayload.name);
    console.log('Given Name: ' + responsePayload.given_name);
    console.log('Family Name: ' + responsePayload.family_name);
    console.log("Image URL: " + responsePayload.picture);
    console.log("Email: " + responsePayload.email);
}

但缺失g_csrf_token等可能通过POST请求返回的内容。请问应通过JS代码、HTML头部、ASP代码还是服务器设置解决该跨源问题？解决后是否会收到POST返回的额外数据？

内容的提问来源于stack exchange，提问作者Ali Sheikhpour