Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add rel="noopener" to all inks that have target="_blank" #2960

Closed
tlkiong opened this issue Nov 22, 2017 · 1 comment
Closed

Add rel="noopener" to all inks that have target="_blank" #2960

tlkiong opened this issue Nov 22, 2017 · 1 comment

Comments

@tlkiong
Copy link

tlkiong commented Nov 22, 2017 •
edited
Loading

rel="noopener" should be added to links containing target="_blank" as a precaution against reverse tabnabbing. For more information, please refer to the following article:
"Target="_blank" - the most underestimated vulnerability ever"

For example:
HTML: <a href="http://example.com" target="_blank">Link</a>
Fix: <a href="http://example.com" target="_blank" rel="noopene">Link</a>

On a side note, noreferrer issue has been fixed in Firefox 52.

I suggest to not cater to older browsers as it is futile because there are numerous other security exploits those browsers are susceptible to. If the user wants to be secure, then the user should be using the latest browser.

For further reading:

  1. "The performance benefits of rel=noopener"
  2. "About rel=noopener - What problems does it solve?"
olleolleolle added a commit to olleolleolle/rails_admin that referenced this issue Jul 14, 2019
@olleolleolle
Add rel='noopener noreferrer' to links with target=_blank
da59493 
  - Cater to old Firefox, before 52, with rel=noreferrer as well
    https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/52#HTML
  - See railsadminteam#2960 for more details
@olleolleolle olleolleolle mentioned this issue Jul 14, 2019
Merged
@mshibuya
Copy link
Member

Fixed by #3169.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@mshibuya @tlkiong