3

We've had a policy to always set rel="noopener" for all external links.

However is that necessary if the external link is to a site in our own control? Let's say we own both coffee.example.com and milk.example.com - should we add those attributes when linking from one site to the other?

To me it feels unnecessary.

However, a colleague disagrees and says it's always a good idea to include at least rel="noopener" when linking to ANY other site, no matter what.

EDIT: I also notice that Lighthouse will complain about external links without rel="noopener". So the question is if it's just considered best practice to add that attribute for all external links even if you control the site being linked to.

6

Is it necessary? No. Is it best practice to do it anyway? Yes.

Here are a few reasons:

  • Ownership and management of external sites can change, leaving them in less trusted hands. You would need to remember to go back and change all your links.

  • The hosting setup of external sites (even subdomains) can be heterogeneous, meaning that a compromise in the server software of one domain could more easily compromise the experience of visitors to the other domain.

  • By always using noopener, you don't need to keep a list of "trusted" and "untrusted" domains, then audit your links to make sure the links to untrusted domains have the noopener attribute. If your policy is to add noopener to all external links, it's easy to tell at a glance if a particular link is noncompliant with your policy.

1
2

I fully agree with Max's answer, rel-noopener is always best practice. One important thing to add:

When linking to external sources, it's common to have them open in a new tab. Ex: supplementary links in an article, etc. This is accomplished with target="_blank". This is fine but it must be combined with rel-noopener.

On it's own,target="_blank"can expose your site to performance and most notably security issues (which Max alludes to). This is because the linked page can access your window object via the window.opener property. As a result, it becomes possible to redirect the user to a malicious URL.

Adding rel="noopener" (or even rel="noreferrer") to your target="_blank" external links is a way around this. So you'd have:

<a href="https://examplepetstore.com" target="_blank" rel="noopener">
  Example Pet Store
</a>

Even if you control the external site, it's still an external site. It could get hacked without your knowledge and something malicious could sit there wreaking havoc before you realize it. In my experience it's always best to treat the idea of getting compromised as a when, not an if.

4
  • 1
    As a user, I find target="_blank" to be a major pain in the ass. Any sort of extensive cross-site browsing breaks the "back" button and leaves me with a pile of tabs that I need to close one at a time, rather than just closing one tab when I'm done with what I'm doing.
    – Mark
    Nov 11 '21 at 22:07
  • @Mark Definitely a personal preference thing. Personally, I think it largely depends on what you're primarily doing/reading and the device you're doing it on. On desktop I love organizing my tasks by tab. On mobile new tabs drive me nuts. In one case I'm focused on a task, and the other I'm browsing leisurely. Nov 11 '21 at 22:21
  • 2
    FYI: Modern browsers now automatically set rel=noopener whenever target="_blank" is used.
    – Barmar
    Nov 12 '21 at 15:45
  • @Barmar What is this sorcery Nov 12 '21 at 19:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.