31–40 of 115 posts
Well I just had an "Oh sh*t" moment thinking about all the websites I built over the years at my old company that had target=_blank to commentors sites... Aw crap. Not my problem anymore, but I never even considered this.
Maybe you could send them a note? Do you know anybody who's still working on the project?
Does this "work" for cross origin requests? If I plant a `target=_blank` in my website, user clicks it, goes to my second website, do I have control over the website the link came from? If not, I don't see the security issue. Of course you can XSS yourself, what have you.
To some extent.. Yes. The attacker can replace the current page with his own phising page. Of course, the hostname part of the url would change, but the user is unlikely to notice that.
sigh This is a perfect example of a title that should not have been changed. The original was objectively better than the current one. If you don't already know what rel=noopener is, you'd have no reason at all to click through on this. But the earlier title actually explained something about the content on the other end of the link.
sigh This is a perfect example of a title that should not have been changed. The original was objectively better than the current one. If you don't already know what rel=noopener is, you'd have no reason at all to click through on this. But the earlier title actually explained something about the content on the other end of the link.
HN submissions are kind of like startups. Often you have to break the rules to get off the ground. But once you have some lift, it's time to become boring and straighten out.
sigh This is a perfect example of a title that should not have been changed. The original was objectively better than the current one. If you don't already know what rel=noopener is, you'd have no reason at all to click through on this. But the earlier title actually explained something about the content on the other end of the link.
It would be helpful if you stated what the original title actually was, especially now that you have the top-level post!
Is there a practical reason that a reference to the opener window is given to the opened window? That seems like something we could do without.
Earlier quoted context omitted.
HN submissions are kind of like startups. Often you have to break the rules to get off the ground. But once you have some lift, it's time to become boring and straighten out.
I have no idea what this submission is about. Why would I want rel=noopener?
You want rel=noopener because the page it navigates to can't affect the content of the opening page.
> Note that this also works when index.html and malicious.html are on different origins — window.opener.location is accessible across origins! ... Why. Why would anyone (not maliciously) consider this desirable behaviour?
Agreed. But what's more intriguing to me is that the proposed "solution" is to add yet another hack on top of that (rel=noopener), instead of doing something to fix the broken behavior of target=_blank. I doubt that many sites rely on this broken behavior. And even if they do, browsers could still block it and show some warning to the user "Hey, this tab that just opened wants to change the URL of this other tab [all…
Any web based system where a pop up dialog is opened to allow the user to select something that is then inserted into the original page?