Don't open user-supplied links with target="_blank"

Henning Koch

March 15, 2016Software engineer at makandra GmbH

The HTML spec was changed to prevent window.opener from accessing the parent page. This is implemented by all browsers except IE11.

This will give the target site full access to your Javascript environment through window.opener, if the target is on the same domain.

Illustration money motivation

Opscomplete powered by

Save money by migrating from AWS to our fully managed hosting in Germany.

Trusted by over 100 customers
Ready to use with Ruby, Node.js, PHP
Proactive management by operations experts

Read more Show archive.org snapshot

Even if the target site is on another domain, it still has some access and can for example manipulate window.location to perform a phishing attack.

You may use a rel="noopener" attribute to avoid this in modern browsers, except IE or Edge.

mathiasbynens.github.io

License for source code

Posted by Henning Koch to makandra dev (2016-03-15 13:28)