Skip to content
Search Create account

DEV Community

DEV Community is a community of 771,734 amazing developers

We're a place where coders share, stay up-to-date and grow their careers.

Create account Log in
Twitter Facebook Github Instagram Twitch
Cover image for target="_blank" is a security risk?
Hassan Tahir
Hassan Tahir

Posted on

target="_blank" is a security risk?

#security #html #javascript #webdev

As we all use target="_blank" to open the link into new tab of a window but everyone should know a risk inside it.

When we open a new tab link window.opener get triggered which made a limited access to the specific tab opened, for example; you can not go back in the previous page by clicking back button from your URL bar.

So what is the risk here?
when the new tab link open it can alter the Link page URL from window.opener.location.
If your external link is not trusty that may cause a real problem to your website.

What can happen?

  1. Hacker can redirect your domain.
  2. CSRF can be performed.
  3. XML entities can be altered.

How to prevent this?
Do not forget to add relation attribute in your link tag rel=noopener noreferrer

In a Nutshell <a href="https://thehassantahir.web.app" target="_blank" rel="noopener noreferrer">Thehassantahir</a>

Discussion (0)