3 ms·
Why on earth does target="_blank" expose window.opener to the new page - that opens up some mad tracking possibilities if you have JS in the opened page (e.g. A
by andy_ppp 10y ago
Why on earth does target="_blank" expose window.opener to the new page - that opens up some mad tracking possibilities if you have JS in the opened page (e.g. Analytics or comments).
Seems the default should be rel="noopener"...
- methyl 10y agoAt least for cross-domain URLs.
- andy_ppp 10y agoI've worked out why this is allowed... if you middle click (open in a new tab) a pop up that uses a link (but intercepts the event by default) window.opener will still work in the new tab. The sibling is right, this should be same domain only.