6

Is the use of noreferrer enough for links that use target="_blank" in order to avoid reverse tabnabbing

For context here is an explanation of the issue:

So my question is: what's the consequence of forgetting to add also noopener and nofollow (that I see used on most websites)?

Are there browsers that are affected by the lack of the last two attributes?

As far as I know the safest solution is to launch the link in a new tab from a temporary iframe but I see some websites out there using only noreferrer so I was wondering if there's some issue using only noreferrer.

  • 2
    Please define "secure links". If it is to block child window from accessing parent window, "noreferrer" is enough in almost all browsers. Setting rel="noreferrer" also implies "noopener". Whereas "nofollow" has completely different purpose. There might, however, be older browsers which require "noopener" as well. caniuse.com/#search=noopener shows IE and Edge don't support "noopener" – 1lastBr3ath Jun 16 '18 at 3:12
  • It is not clear from the question what you consider "secure" and "enough to secure", i.e. what kind of attack you want to defend against. Please describe the context needed to understand what you are asking in your question instead of just linking to some external site. – Steffen Ullrich Jun 16 '18 at 3:43
  • For secure links in this case I mean only that it's not possible to redirect the page where the link was opened from. – Ga Sacchi Jun 16 '18 at 4:47
2

Only set up noreferer if you are privacy-paranoid. noopener otherwise. At least one of these two must be present on links pointing to external websites in a new browsing context (there is a target value). Add nofollow for unrelated (ad partners) websites.

noreferrer includes the behavior of noopener, which is the most important one from a security point of view (see this for an example of attack). So noreferrer noopener = noreferrer.

nofollow indicates that you don't endose any responsibility for this link so it won't change anything for security (Search engine might still follow this link)

Don't do complex things with iframe for such a simple result as opening a link (you will break native security in browsers).

  • Reading more around I think that the reason for the need of the temporary iframe is Safari: github.com/danielstjules/blankshield#solutions – Ga Sacchi Jun 18 '18 at 6:28
  • The problem is that if only noopener is used it's possible to perform tabnabbing in IE/Edge. If only nofollow is used both IE/Edge and FF are effected. That's why these tests were successful in redirecting the facebook page: steemit.com/security/@gaottantacinque/… – Ga Sacchi Jun 18 '18 at 6:28
  • Regarding iframes I don't think it's that bad to use them as far as they're used in the right way. I wrote more about it here: steemit.com/security/@gaottantacinque/… Thanks – Ga Sacchi Jun 18 '18 at 6:29
  • 1
    @GaSacchi You don't fix a browser by changing code in your website (since it might break the correctly-behavioring browsers). If Safari/IE/Edge/Whatever is vulnerable to some attacks, the it's Safari/IE/Edge/Whatever team job to fix that, not yours. Using temporary iframe is bad since it might force you to allow iframing, so you must alter your Content Security Policy. Plus, it might mess with user's browsing history (so would be bad from a UX view) – Xenos Jun 18 '18 at 7:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.