Search This Blog

Wednesday, August 12, 2020

use target="_blank" rel="noopener noreferrer" to prevent fraud and page hijacking

When searching Google, you're presented with results that seemingly has direct links.   You see them by mousing over the links and the true url is displayed in the browser's status bar:



For all hyperlinks, Google inserts a click and onmousedown event in order for the href hyperlink address to quickly change to their /url data collector link.  This tallies the number of advertising clicks and you can understand how /url is Google's most valued, ahem, url.

Note that there are readily available browser plugins which cripple google's url bait-and-switch events in order to circumvent tracking.  These plugins make google work more like the DuckDuckGo.com engine which doesn't track you near as much.

Speaking of url links, when you click one, search engines do not employ a target="_blank" to open a new windows (or tab).  You have to right-click->open in new tab if you want that to happen.   Normally the search engine page politely goes away and is replaced with your destination website like how normal links work since day one.

However, if your browser was to open up a new tab with the use of the target="_blank" function, then that new page could certainly be capable of hijacking the previous page.  The new page can run javascript to cause it's parent page's location to go somewhere else like a phishing site.  This is because the default permission is to allow for a new windows/tabs to have control of it's parent window/tabs.  Image if a rogue site silently replaced your parent page with a look-a-like scam page?  So, to protect us normal citizens,  browsers employed the new "noopener" parameter.

The noopener keyword for the rel attribute of the <a>, <area>, and <form> elements instructs the browser to navigate to the target resource without granting the new browsing context access to the document that opened it — by not setting the Window.opener property on the opened window (it returns null).

There is a nice write up on why you need to use "noopener noreferrer" IMMEDIATELY on all your external links: https://www.reliablesoft.net/noreferrer-noopener/