3 ms·
Window.opener isn’t your problem. Window.opener is sandboxed by CORS. And you need it for things such as oAuth. Target=“_blank” is your problem. That’s where W
by mygo 9y ago
Window.opener isn’t your problem. Window.opener is sandboxed by CORS. And you need it for things such as oAuth.
Target=“_blank” is your problem. That’s where Window.opener gets exposed. You’re better off finding the “_blank” definition and renaming it so that it’s never triggered, or assigning it to the definition of “self”, etc.
- Grom_PE 9y agoKilling off "_blank" would disable force-opening links in a new window, which is useful in dynamic context, e.g. chat page, so I don't want that. Also, window.opener is still abusable if I middle-click links to open in a new tab. I was very surprised when my Google Search tab got replaced by something else after I middle-clicked on some questionable link.