3

In numerous sites I have been reading, they say that you must use rel="noreferrer noopener" when using target="_blank" within external links.

I can understand why you should use noopener as a precaution against reverse tabnapping and also for performance benefits. I also understand using noreferrer for older browsers such as Firefox versions 51 and below due to the fact they do not support noopener, but as suggested in GitHub:

Trying to cater to older browsers is futile because there are numerous other security exploits those browsers are susceptible to. If the user wants to be secure, then the user should be using the latest browser.
- mojavelinux's comment (May 1, 2017)

Using noreferrer also affects Google Analytics data, and with the following stats:

What is the current stance regarding use of noreferrer within target="_blank" external links? Must it still be used for security purposes or can it now be dropped?

  • Presumably you are referring to external site links? – DocRoot Jun 8 '19 at 21:02
  • Sorry yes @DocRoot I have edited to suit – Chris Rogers Jun 8 '19 at 21:05
1

rel="noreferrer" doesn't affect security. It is for your own privacy (or for being secretive).

If your page has a link to a page on site-X, when someone clicks on it, the log file on site-X will record the fact that your site provided the link.

Generally this could be considered a good thing. For instance they might notice that they are getting many referrals from your site, investigate, like what they see, and add their own links to your site. This would increase your own search rating.

But perhaps you don't want site-X to know that you have links to their pages. In that case, you'd add rel="noreferrer" to your link, and the other site will not be told about your link.

See also: html - When should I use rel=noreferrer? - Stack Overflow

| improve this answer | |
  • If the URLs on your site could contain sensitive information, rel="noreferrer" is a security measure that can help prevent leaks. Even session ids in URLs could cause a security vulnerability if leaked. – Stephen Ostermiller Jan 28 at 18:59
  • Surely it is bad practice to have sensitive information in your URLs. GET requests should never be used for sensitive data and POST is more secure @StephenOstermiller – Chris Rogers May 28 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.