Security

`security/window-open-noopener`

window.open for another site passes "noopener" (and "noreferrer" when needed) so the new page cannot control yours.

Why

A page opened with window.open keeps a reference to your window in window.opener and can navigate it, for example to a fake login page while the user looks at the new tab (tabnabbing). Links with target="_blank" imply noopener in current browsers, but window.open does not.

Fix

Pass the features string: window.open(url, '_blank', 'noopener,noreferrer'). Keep the opener only for your own popups that must talk back (an OAuth popup), and then check event.origin on the messages (security/postmessage-origin).

Examples

// bad
window.open(partnerUrl, '_blank')
// good
window.open(partnerUrl, '_blank', 'noopener,noreferrer')

Sources

Facts

Id: security/window-open-noopener
Severity: minor
Check: static checked in the source by audit
Applies to: html jsx vue svelte astro
Taught by the skill: fe-security Front-end security
Since version: 0.1.0

Rule file on GitHub

Read it in the terminal

npx github:dawidolko/frontend-skills explain security/window-open-noopener