About rel=noopener

Re:About rel=noopener by doughj3 on Friday April 22, 2016 @11:09PM (#11553960)

I'm using Chromium and even the link with `rel=noopener` seems to be able to "hax" the first page. Am I reading it wrong or is `rel=noopener` supposed to protect against this?

[ Parent | on HN ]

Re:About rel=noopener by illuna on Friday April 22, 2016 @11:37PM (#11554049)

It's a bit confusing if you didn't pay close attention to the article, because neither link actually show the `rel=noopener` fix.

Instead, the two links present two different angles to the same problem. The first link demonstrates the attack using a page within the same domain (reasonable), and the second demonstrates that it will continue to work even when the link points to a page ordinarily restricted by cross-origin policies (potentially surprising).

If you manually add `rel=noopener` to either link, the attack won't work. Try it with DevTools.

[ Parent | on HN ]

Re:About rel=noopener by kaoD on Saturday April 23, 2016 @05:21AM (#11554815)

Maybe the page changed? I see 3 links: non-Cross-Origin, Cross-Origin and noopener. The third one doesn't "hack" the page for me.

[ Parent | on HN ]

Re:About rel=noopener by cgm616 on Friday April 22, 2016 @11:28PM (#11554023)

Same here on Firefox for iOS. Both links show the "hacked" text.

[ Parent | on HN ]