4 ms·
I'm using Chromium and even the link with `rel=noopener` seems to be able to "hax" the first page. Am I reading it wrong or is `rel=noopener` supposed to protec
by doughj3 10y ago
I'm using Chromium and even the link with `rel=noopener` seems to be able to "hax" the first page. Am I reading it wrong or is `rel=noopener` supposed to protect against this?
- cgm616 10y agoSame here on Firefox for iOS. Both links show the "hacked" text.
- illuna 10y agoIt's a bit confusing if you didn't pay close attention to the article, because neither link actually show the `rel=noopener` fix. Instead, the two links present two different angles to the same problem. The first link demonstrates the attack using a page within the same domain (reasonable), and the second demonstrates that it will continue to work even when the link points to a page ordinarily restricted by cross-origin policies (potentially surprising). If you manually add `rel=noopener` to either link, the attack won't work. Try it with DevTools.
- kaoD 10y agoMaybe the page changed? I see 3 links: non-Cross-Origin, Cross-Origin and noopener. The third one doesn't "hack" the page for me.