style(eslint): allow referrers in target="_blank" links #11867
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Bundle StatsHey there, this message comes from a github action that helps you and reviewers to understand how these changes affect the size of this project's bundle. As this PR is updated, I'll keep you updated on how the bundle size is impacted. Total
View detailed bundle breakdownAdded No assets were added Removed No assets were removed Bigger No assets were bigger Smaller No assets were smaller Unchanged
|
argl
reviewed
Sep 29, 2024
There was a problem hiding this comment.
I would like to express a different view. Even if we do not leak paths and query strings to the target site, it is still leaking something that not all users are comfortable with. The general consensus seems to be that noreferrer is best practice. Falling back to the default behaviour of Referrer-policy is mainly a SEO inprovement for the target site. Or did I miss something here?
In any case, even if we do that, I would prefer an explicit Referrer-Policy header then, to make our intent explicit.
LeoMcA
approved these changes
Sep 30, 2024
+1 for aligning the links in a follow-up PR |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Problem
We currently add
rel="noreferrer"to all external links in our client, which has two effects:rel="noopener"(see here).However, there is no reason to hide MDN as the referrer, because the default
Referrer-Policyapplies, so that the destination only seeshttps://developer.mozilla.org/.Solution
Update the ESLint config for the
client/and allow referrers in thereact/jsx-no-target-blankrule.Note: The rule will still require
noopenerinstead.How did you test this change?
Made the change in #11865 and it had the effect.