Skip to content

Commit 517d127

Browse files
committed
<a target="_blank"> has implicit noopener as per spec.
See: whatwg/html#4330 Removed the wordings that could imply the behavior is vendor-specific. Added links to Browser compatibility for easy reference.
1 parent 91d2f42 commit 517d127

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

files/en-us/web/api/window/opener/index.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ <h3 id="Value">Value</h3>
4747
<code>{{htmlattrxref("rel", "a")}}=noopener</code> on a link, or passing
4848
<code>noopener</code> in the {{domxref("Window.open", "windowFeatures")}} parameter.
4949
</li>
50-
<li>From Firefox 79, windows opened because of links with a {{htmlattrxref("target",
50+
<li>Windows opened because of links with a {{htmlattrxref("target",
5151
"a")}} of <code>_blank</code> don't get an <code>opener</code>, unless explicitly
5252
requested with <code>{{htmlattrxref("rel", "a")}}=opener</code>.</li>
5353
<li>Having a {{HTTPHeader("Cross-Origin-Opener-Policy")}} header with a value of

files/en-us/web/html/element/a/index.html

+2-2
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ <h2 id="Attributes">Attributes</h2>
9494
</div>
9595

9696
<div class="note">
97-
<p><strong>Note:</strong> In newer browser versions (e.g. Firefox 79+) setting <code>target="_blank"</code> on <code>&lt;a&gt;</code> elements implicitly provides the same <code>rel</code> behavior as setting <code>rel="noopener"</code>.</p>
97+
<p><strong>Note:</strong> Setting <code>target="_blank"</code> on <code>&lt;a&gt;</code> elements implicitly provides the same <code>rel</code> behavior as setting <code>rel="noopener"</code>. See <a href="#Browser_compatibility">browser compatibility</a> for support status.</p>
9898
</div>
9999
</dd>
100100
<dt id="type">{{HTMLAttrDef("type")}}</dt>
@@ -319,7 +319,7 @@ <h2 id="Security_and_privacy">Security and privacy</h2>
319319

320320
<p><code>&lt;a&gt;</code> elements can have consequences for users’ security and privacy. See <a href="/en-US/docs/Web/Security/Referer_header:_privacy_and_security_concerns"><code>Referer</code> header: privacy and security concerns</a> for information.</p>
321321

322-
<p>Using <code>target="_blank"</code> without <code>rel="noreferrer"</code> and <code>rel="noopener"</code> makes the website vulnerable to {{domxref("window.opener")}} API exploitation attacks (<a href="https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/">vulnerability description</a>), although note that, in newer browser versions (e.g. Firefox 79+) setting <code>target="_blank"</code> implicitly provides the same protection as setting <code>rel="noopener"</code>.</p>
322+
<p>Using <code>target="_blank"</code> without <code>rel="noreferrer"</code> and <code>rel="noopener"</code> makes the website vulnerable to {{domxref("window.opener")}} API exploitation attacks (<a href="https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/">vulnerability description</a>), although note that, in newer browser versions setting <code>target="_blank"</code> implicitly provides the same protection as setting <code>rel="noopener"</code>. See <a href="#browser_compatibility">browser compatibility</a> for details.</p>
323323

324324
<h2 id="Accessibility">Accessibility</h2>
325325

0 commit comments

Comments
 (0)