News for hackers. Stuff that matters.

A comment on Sites using Facebook ‘Like’ button liable for data, EU court rules. Parent comment

Re:Sites using Facebook ‘Like’ button liable for data, EU co... by daxterspeed on Sunday August 04, 2019 @04:01PM (#20608903)
Note that by not setting rel="noopener noreferrer" on the links you let the linked sites control the opener window (and of course see a detailed referrer header).

https://www.jitbit.com/alexblog/256-targetblank---the-most-u... (This applies to more than just target="_blank")

[ Parent | on HN ]
Re:Sites using Facebook ‘Like’ button liable for data, EU co... by StavrosK on Sunday August 04, 2019 @06:29PM (#20609636)
You are correct, fixed, thank you. It's a shame this isn't the default on all links.
[ Parent | on HN ]
Re:Sites using Facebook ‘Like’ button liable for data, EU co... by _delirium on Sunday August 04, 2019 @08:18PM (#20610088)
For the case of opening in a new tab, consensus seems to be moving to making it default, though that's not true everywhere yet. It's currently default on Safari and Firefox.

Closed (fixed) Firefox bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1503681

Open Chromium bug: https://bugs.chromium.org/p/chromium/issues/detail?id=898942

[ Parent | on HN ]
Re:Sites using Facebook ‘Like’ button liable for data, EU co... by yzmtf2008 on Sunday August 04, 2019 @04:12PM (#20608962)
If the link is for users to click and like this page on Facebook, then Facebook will be able to know the source URL regardless, no?
[ Parent | on HN ]
Re:Sites using Facebook ‘Like’ button liable for data, EU co... by daxterspeed on Sunday August 04, 2019 @04:23PM (#20609013)
Well if the referrer header matches the shared url it's just bloat in the request headers, and if it doesn't it's possibly leaking details it shouldn't, like perhaps a token in a query parameter. Twitter, Facebook, etc doesn't really need to know where a user initiated a share anyway.

Either way making sure that window.opener isn't available to random sites is a critical security feature and in some browsers that require you to set noreferrer, so better safe than sorry.

[ Parent | on HN ]