security/window-open-noopener

Dlaczego

A page opened with window.open keeps a reference to your window in window.opener and can navigate it, for example to a fake login page while the user looks at the new tab (tabnabbing). Links with target="_blank" imply noopener in current browsers, but window.open does not.

Poprawka

Pass the features string: window.open(url, '_blank', 'noopener,noreferrer'). Keep the opener only for your own popups that must talk back (an OAuth popup), and then check event.origin on the messages (security/postmessage-origin).

Przykłady

// bad
window.open(partnerUrl, '_blank')
// good
window.open(partnerUrl, '_blank', 'noopener,noreferrer')

Źródła

• MDN, Window open() (windowFeatures, noopener)
• MDN, rel="noopener"

Przeczytaj w terminalu

npx github:dawidolko/frontend-skills explain security/window-open-noopener