Add
rel="noopener"
to outgoing links withtarget="_blank"
for security and better performance.
But is this enough nowadays?
There are already a good number of pages and articles about this topic I found. In general, they all say the same but then they also differ from each other.
On the one hand, some recommend using
rel="noopener noreferrer"
in combination to be safe also for some older browsers for broader compatibility. (e.g. see: rel="noreferrer noopener" in target="_blank" external links)On the other hand, some say that
noreferrer
does the same asnoopener
but also removes information about the referrer. This is not always the wanted behavior and breaks advertising and analytics data since this traffic is seen as "direct" traffic. (e.g. see: Should I use the 'noreferrer' attribute on my website links (to open in a new window) as a safety measure? or HTML Links: noopener vs noreferrer)
What about compatibility?
On caniuse.com we can check for some:
We can see that noreferrer
has better compatibility. But also, IE11 support is combined with some warnings here, so I checked it manually. There is a good demo page that I found that we can use for testing the security issue: https://mathiasbynens.github.io/rel-noopener/
rel="noopener"
is not working on IE11rel="noreferrer"
is solving that security issue for IE11
What does Google say?
Google recommends using either noopener
or noreferrer
. They explicitly also saying that setting noopener
helps protect users of legacy browsers.
[...] Explicit specification of rel="noopener" helps protect users of legacy browsers including Edge Legacy and Internet Explorer. [...]
See here: https://web.dev/external-anchors-use-rel-noopener/
Conclusion?
So, what is now our conclusion? I don't have an answer to this but of course we can say that setting both is more secure because it is better supported. We for example want to support IE11 still since we have lots of users coming with this browser. But since it also breaks analytics, I can't live with this.
What are your opinions on this?
Is it depending on the browsers you would like to support or can we assume that other security issues are way heavier so that we can go for noopener
. Users of older browsers are anyway insecure in way more areas ...
rel="noopener"
breaks the links in IE 11, it just doesn't give the security benefits. It shouldn't hurt to put it in if it help security in other browsers. – Stephen Ostermiller♦ Jan 12 at 12:39