About rel=noopener (2016)
mathiasbynens.github.io
About rel=noopener (2016)
1–10 of 48 posts
Re: About rel=noopener (2016)
#2Excellent, concise and with solid examples too! I can't see any reason to not expect this as the default behavior, especially in today's hostile climate. It almost seems as if the standards writers have a stake in making sure there is always a place in the picnic basket for an unseen finger...
Re: About rel=noopener (2016)
#3Shouldn't this behavior be explicitly enabled, defaulting to disallowing it?
Or do I need to tag all my links with a long series of "Don't allow this crazy thing", "Or that other thing", etc.
Re: About rel=noopener (2016)
#4I think this is an older article?* Any updates on support?
* I also don't understand how this is being served. If you go to https://github.com/mathiasbynens there should be a repository called mathiasbynens.github.io right? But I can't find it.
Re: About rel=noopener (2016)
#5Shouldn't this behavior be explicitly enabled, defaulting to disallowing it? Or do I need to tag all my links with a long series of "Don't allow this crazy thing", "Or that other thing", etc.
Lots of existing apps, including some that handle payment information, rely on window.opener to provide a seamless experience when using pop-ups or iframes from a different domain.
In an ideal world, these apps would have been rewritten a long time ago using more modern techniques. In reality, browsers bend over backwards to maintain backward compatibility with existing apps.
Re: About rel=noopener (2016)
#6I think this is an older article?* Any updates on support? * I also don't understand how this is being served. If you go to https://github.com/mathiasbynens there should be a repository called mathiasbynens.github.io right? But I can't find it.
> there should be a repository called mathiasbynens.github.io right
Not exactly - the subdomain is the account and the path name is the repository (and the repository's `gh-pages` branch is what's returned).
Re: About rel=noopener (2016)
#7I think this is an older article?* Any updates on support? * I also don't understand how this is being served. If you go to https://github.com/mathiasbynens there should be a repository called mathiasbynens.github.io right? But I can't find it.
> there should be a repository called mathiasbynens.github.io right Not exactly - the subdomain is the account and the path name is the repository (and the repository's `gh-pages` branch is what's returned). ( https://github.com/mathiasbynens/rel-noopener )
Didn't know you could do that, thanks! Also, this confirms last edit Nov 2016.
Re: About rel=noopener (2016)
#8Shouldn't this behavior be explicitly enabled, defaulting to disallowing it? Or do I need to tag all my links with a long series of "Don't allow this crazy thing", "Or that other thing", etc.
Lots of existing apps, including some that handle payment information, rely on window.opener to provide a seamless experience when using pop-ups or iframes from a different domain. In an ideal world, these apps would have been rewritten a long time ago using more modern techniques. In reality, browsers bend over backwards to maintain backward compatibility with existing apps.
I remember this very thing being discussed years ago.
Since this is still a problem, I'd say the web needs a way to gracefully migrate away from bad decisions like window.opener being available across origins.
Should we not decide that cross-origin window.opener is now deprecated, show big fat warnings on the developer console when it's used, and remove it in a year or two? I'd like an option to completely turn it off on my browser. Like third-party cookies, cross-origin access to just about anything is a bad idea.
Re: About rel=noopener (2016)
#9Shouldn't this behavior be explicitly enabled, defaulting to disallowing it? Or do I need to tag all my links with a long series of "Don't allow this crazy thing", "Or that other thing", etc.
[deleted]
Re: About rel=noopener (2016)
#10There's a Firefox extension to add the rel=noopener attribute to all links (except ones to the same domain): https://addons.mozilla.org/en-US/firefox/addon/dont-touch-my...