rel="noopener"to outgoing links with
target="_blank"for security and better performance.
But is this enough nowadays?
There are already a good number of pages and articles about this topic I found. In general, they all say the same but then they also differ from each other.
On the one hand, some recommend using
rel="noopener noreferrer"in combination to be safe also for some older browsers for broader compatibility. (e.g. see: rel="noreferrer noopener" in target="_blank" external links)
On the other hand, some say that
noreferrerdoes the same as
noopenerbut also removes information about the referrer. This is not always the wanted behavior and breaks advertising and analytics data since this traffic is seen as "direct" traffic. (e.g. see: Should I use the 'noreferrer' attribute on my website links (to open in a new window) as a safety measure? or HTML Links: noopener vs noreferrer)
What about compatibility?
On caniuse.com we can check for some:
We can see that
noreferrer has better compatibility. But also, IE11 support is combined with some warnings here, so I checked it manually. There is a good demo page that I found that we can use for testing the security issue: https://mathiasbynens.github.io/rel-noopener/
rel="noopener"is not working on IE11
rel="noreferrer"is solving that security issue for IE11
What does Google say?
Google recommends using either
noreferrer. They explicitly also saying that setting
noopener helps protect users of legacy browsers.
[...] Explicit specification of rel="noopener" helps protect users of legacy browsers including Edge Legacy and Internet Explorer. [...]
So, what is now our conclusion? I don't have an answer to this but of course we can say that setting both is more secure because it is better supported. We for example want to support IE11 still since we have lots of users coming with this browser. But since it also breaks analytics, I can't live with this.
What are your opinions on this?
Is it depending on the browsers you would like to support or can we assume that other security issues are way heavier so that we can go for
noopener. Users of older browsers are anyway insecure in way more areas ...