2 ms·
Not just weird behavior, but possible security issues. Browsers now automatically add a rel="noopener" to links that target _blank to prevent the opened site fr
by shkkmo 2y ago
Not just weird behavior, but possible security issues. Browsers now automatically add a rel="noopener" to links that target _blank to prevent the opened site from gaining full access to your javascript object. Targeting _new does not do this unless you explicity add the rel="noopener" yourself.
https://github.com/whatwg/html/issues/4078 https://github.com/whatwg/html/issues/4078
https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/rel/noopener https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...
- cxr 2y agoNobody gets "full access" to your "javascript object"—whatever that even means; pages from different origins will still run into exceptions when trying to diddle the opener. There is a small, well-known set of (safe) properties that are excluded from the restrictions—like location. But the noopener behavior, by making opener null, does stop other pages from setting even opener.location, which could ordinarily be used to programmatically send the user to another page.