CODEWITHSUNDEEP
htmlanchor
brodybits
brodybits

Reputation: 541

How can I avoid vulnerability with target="_blank" in a hyperlink?

I saw the following article on Twitter: https://gosink.in/are-you-making-website-vulnerable-target-blank-or-performance/

It looks like there may be a vulnerability in case a website uses target="_blank" in an HTML anchor (a tag), to make a link that opens in a new tab.

How can I avoid this kind of vulnerability if I need to use this functionality on a website?

Upvotes: 1

Views: 3357

Answers (2)

Wilham
Wilham

Reputation: 11

You should use rel="noopener" or better still rel="noopener noreferrer" but all current versions of major browsers as from 2021 automatically use the behavior of rel="noopener" for any target="_blank" link, So the issue is taken care of.

Upvotes: 1

brodybits
brodybits

Reputation: 541

TL;DR: According to the article, it would be safest to use rel="noopener noreferrer" in the HTML anchor.

For example:

<a href="https://google.com" target="_blank" rel="noopener noreferrer">Google it</a>

I would highly recommend reading the referenced article for a more complete understanding.

The vulnerability may be gone in some newer browsers, but I would not count on it in the near term.

Upvotes: 3

Related Questions