Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Link] Add a noopener attribute on external link #2902

Open
renow-luxembourg opened this issue Dec 5, 2024 · 0 comments
Open

[Link] Add a noopener attribute on external link #2902

renow-luxembourg opened this issue Dec 5, 2024 · 0 comments

Comments

@renow-luxembourg
Copy link
Contributor

Feature Request

Is your feature request related to a problem? Please describe.
We don't use the rel="noopener" attribute on all our external links. A recent audit reports that we should add it to avoid security issues.

Describe the solution you'd like
It would be great to add automatically the rel attribute like :
<a href="target_page" target="_blank" title="Label - New window" rel="noreferrer noopener">Label</a>

Noopener

  • How it works: When using target="_blank" to open a link in a new tab, the linked page may partially navigate to the original page via window.opener, which can be exploited for phishing attacks. The rel="noopener" attribute prevents this behavior by telling the browser not to set window.opener, thereby protecting the original page.
  • Usage: When a link is opened in a new tab with target="_blank".

Noreferrer

  • How it works: Similar to noopener, it prevents the opened site from manipulating window.opener and prevents the browser from sending the referring page address.
  • Use: For external no-trusted links.
  • Impact: On statistics, it can distort the data by reporting more direct traffic.

Documentation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant