{"id":15364651,"url":"https://github.com/venables/safe-target-blank","last_synced_at":"2025-04-15T09:38:32.658Z","repository":{"id":24811074,"uuid":"28225300","full_name":"venables/safe-target-blank","owner":"venables","description":"Using `target=\"_blank\"` can be insecure.  This helps.","archived":false,"fork":false,"pushed_at":"2017-02-04T20:17:54.000Z","size":13,"stargazers_count":13,"open_issues_count":1,"forks_count":3,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-25T10:47:32.812Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://mattvenables.com/safe-target-blank/","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/venables.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-12-19T10:36:24.000Z","updated_at":"2023-05-23T16:59:11.000Z","dependencies_parsed_at":"2022-08-22T17:20:31.761Z","dependency_job_id":null,"html_url":"https://github.com/venables/safe-target-blank","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/venables%2Fsafe-target-blank","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/venables%2Fsafe-target-blank/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/venables%2Fsafe-target-blank/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/venables%2Fsafe-target-blank/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/venables","download_url":"https://codeload.github.com/venables/safe-target-blank/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249043930,"owners_count":21203565,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-01T13:12:57.678Z","updated_at":"2025-04-15T09:38:32.605Z","avatar_url":"https://github.com/venables.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Safe `target=\"_blank\"` links\n\nUsing `target=\"_blank\"` can be insecure.  Especially if you use these from within a web app.\n\n## Wait, what?\n\nLinks that are opened using `target=\"_blank\"` can control the opener tab in some limited ways.\n\nYes, you read that right.  Thank to the [window.opener](https://developer.mozilla.org/en-US/docs/Web/API/Window.opener) property, new windows have a reference to the window that opened them.\n\n## What's the big deal?\n\nImagine this scenario:\n\n1. I log in to my favorite web app.\n2. I click over to some section, and click a link to a 3rd party.  The developers of the web app don't want me leaving their app, so they made it `target=\"_blank\"`\n3. Unbeknownst to me, the 3rd party was compromised, and a little bit of javascript was injected into their page. This javascript redirected my original window to a copy-cat page which says I need to log in again.\n4. I close the 3rd party tab, and am back on my original (now \"logged out\") tab. Everything looks legit, so I log in again.\n\nI just gave some hackers my login information.\n\nIf you want to see this in action, check out [docs/index.html](https://mattvenables.com/safe-target-blank).\n\n## Wow. So how do I fix this?\n\nThe solution, it turns out, is pretty simple.\n\nJust add `rel=\"noreferrer\"` to your links that use `target=\"_blank\"` ([HTML spec](https://html5.org/r/1950))\n\n## Simple enough, so why does this library exist?\n\nWe're humans, and adding `rel=\"noreferrer\"` is easy to forget, let alone spell (is that one \"r\" or two?)\n\nSo, just add this script to the bottom of your page, like so:\n\n```html\n\u003chtml\u003e\n\u003chead\u003e\n\u003c/head\u003e\n\u003cbody\u003e\n  \u003c!-- stuff --\u003e\n\n  \u003cscript src=\"//code.mattvenables.com/safe-target-blank/safe-target-blank.min.js\"\u003e\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n## Installation:\n\nYou can install safe-target-blank in several ways:\n\n1. Include the hosted JS directly on your page\n\n    ```html\n    \u003cscript src=\"//code.mattvenables.com/safe-target-blank/safe-target-blank.min.js\"\u003e\u003c/script\u003e\n    ```\n\n2. Install via npm (or yarn), and require it (for use with Webpack or Browserify)\n\n     ```bash\n     npm install safe-target\n     ```\n\n     ```bash\n     yarn add safe-target\n     ```\n\n3. Install via Bower\n\n     ```bash\n     bower install safe-target\n     ```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvenables%2Fsafe-target-blank","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvenables%2Fsafe-target-blank","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvenables%2Fsafe-target-blank/lists"}