`noopener`/`noreferrer` - What do you “really” need to use nowadays? [Discussion] [closed]

Question

Add rel="noopener" to outgoing links with target="_blank" for security and better performance.

But is this enough nowadays?

There are already a good number of pages and articles about this topic I found. In general, they all say the same but then they also differ from each other.

• On the one hand, some recommend using rel="noopener noreferrer" in combination to be safe also for some older browsers for broader compatibility. (e.g. see: rel="noreferrer noopener" in target="_blank" external links)

• On the other hand, some say that noreferrer does the same as noopener but also removes information about the referrer. This is not always the wanted behavior and breaks advertising and analytics data since this traffic is seen as "direct" traffic. (e.g. see: Should I use the 'noreferrer' attribute on my website links (to open in a new window) as a safety measure? or HTML Links: noopener vs noreferrer)

What about compatibility?

On caniuse.com we can check for some:

• https://caniuse.com/rel-noreferrer
• https://caniuse.com/rel-noopener

We can see that noreferrer has better compatibility. But also, IE11 support is combined with some warnings here, so I checked it manually. There is a good demo page that I found that we can use for testing the security issue: https://mathiasbynens.github.io/rel-noopener/

• rel="noopener" is not working on IE11
• rel="noreferrer" is solving that security issue for IE11

What does Google say?

Google recommends using either noopener or noreferrer. They explicitly also saying that setting noopener helps protect users of legacy browsers.

[...] Explicit specification of rel="noopener" helps protect users of legacy browsers including Edge Legacy and Internet Explorer. [...]

See here: https://web.dev/external-anchors-use-rel-noopener/

Conclusion?

So, what is now our conclusion? I don't have an answer to this but of course we can say that setting both is more secure because it is better supported. We for example want to support IE11 still since we have lots of users coming with this browser. But since it also breaks analytics, I can't live with this.

What are your opinions on this?

Is it depending on the browsers you would like to support or can we assume that other security issues are way heavier so that we can go for noopener. Users of older browsers are anyway insecure in way more areas ...