Post
Topic
Board Meta
Re: Links should open in a new tab - Target="_blank"
by
BenCodie
on 29/03/2023, 08:37:19 UTC
Do not use target="_blank" by itself, it is a security vulnerability! (more information here)

Instead, you should use both target="_blank" AND rel="noopener noreferrer" to mitigate the vulnerability.

Nice! I had no idea about his. It should be noted though, that the vulnerability is available only to those who have access to the site that is using target="_blank"

Quote from: perishablepress.com
Think of it this way. In order for the blank-target hack to work, the attacker must have control of the target page. For example, if I have a blank-target link pointing at Facebook, like this:

<a href="https://www.facebook.com/" target="_blank" rel="noopener noreferrer">Facebook</a>

For this blank-target link to be exploited, the attacker must have control of the Facebook homepage, in order to execute whatever malicious script...

So unless someone has control over bitcointalk.org's server, it isn't really a vulnerability that would be active at all times. Nonetheless, a vulnerability is a vulnerability and the door shouldn't be opened if it doesn't need to be.

Either way, I am with LoyceV on this one. Right click, open in new tab. If on mobile, hold the link/copy the link, open it in a new tab. The convenience of skipping one or two clicks is really not necessary.

Please don't add this! I hate sites that decide when I get a new window (which my browser turns into a new tab). If it's a normal link, I can click it with my middle mouse button to open in a new tab on the background. I use that feature all the time.
But if the website decides for me, I can't use a normal click without getting a new tab, which always results in me closing the initial tab (by clicking my middle mouse button on the tab).