Should I use the 'noreferrer' attribute on my website links (to open in a new window) as a safety measure?

Question

There are many sites on the internet that recommend you to add the noopener noreferrer attributes to your link as a safety measure. This is to avoid malicious scripts from other domains to take control of your window (for a link with target="_blank").

There's even an eslint rule to make sure of that:

https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-no-target-blank.md`

https://mathiasbynens.github.io/rel-noopener/

QUESTION

I get the noopener part. It makes sense. But do I really need the noreferrer to be safe?

Answer 1

You only need to use one or the other. From Google tools for web developers -- Links to cross-origin destinations are unsafe:

• rel="noopener" prevents the new page from being able to access the window.opener property and ensures it runs in a separate process.
• rel="noreferrer" attribute has the same effect, but also prevents the Referer header from being sent to the new page.

So there is no need to use both of them. Either of them will prevent the security problem on its own.