There are several attacks possible when embedding links with target="_blank". This is where rel="noopener" and rel="noreferrer" should help.

I am expecting that clicking the following link

<a href="https://google.com" target="_blank" rel="noreferrer">Google</a>

results in a new browser tab, with a new HTML5 session storage.

This works fine with Firefox 65.0, but not with Chromium 71.0 and Chrome 72.0.

The problem is, that with Chrome/Chromium the same HTML5 session storage persists.

Exactly the same behaviour can be observed when using rel="noopener" or rel="noopener noreferrer".

The implementation state is listed at:

My questions are:

  • Is this behaviour appropriate?
  • Am I missing something?
  • How can I achieve the desired behaviour?

Addendum (further observations):

When right-clicking on the link in Chrome/Chromium and clicking either "Open link in new window" or "Open link in new tab", then there will also be created a new session storage. The same applies when holding the ctrl key and clicking the link (= new tab) or holding the shift key and clicking the link (= new window).

Further reading:

  • Why do you think that noopener or noreferrer should have any effect on the session storage? I couldn't find that in any of your links. – Sjoerd Feb 20 at 12:24
  • @Sjoerd I have added a link about the session storage. In general, a session storage gets associated with one particular browser window or browser tab. The added link states "Opening a page in a new tab or window will cause a new session to be initiated with the value of the top-level browsing context, which differs from how session cookies work." Thus, my observation was very unexpected. Furthermore, with Firefox I could observe the intended behaviour. – Anderson Feb 20 at 12:33
  • If I understand it correctly the session storage is copied to the new tab. So you get a new session storage instance with the same values as the original tab. Is that what you're seeing? – Sjoerd Feb 20 at 12:39
  • @Sjoerd Yes, exactly, but only with Chrome/Chromium. Firefox works as expected. – Anderson Feb 20 at 12:41
  • See also bug in Firefox, bug in Chrome. – Sjoerd Feb 20 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.