A new-tab link that hands over the page it left
- Forbidden
target="_blank"with norel- Instead
rel="noopener"on everytarget="_blank",noreferrertoo when the destination has no business knowing where the reader came from.
What this rule looks like
Why this rule
The opened page gets a handle on the window that opened it and can navigate it somewhere else. The reader comes back to a tab that looks like yours and is not. Modern browsers imply noopener for _blank, which is the argument for writing it rather than against: the ones that do not are the ones being attacked.
- Kind
- Rule
- Section
- Things to avoid
- Group
- Safety at the interface
- Bucket
- mechanical
- Severity
- error
- Detector
interface-safety- Since
- v0.14.0