Skip to content

fix: add rel='noopener noreferrer' to external links#729

Open
Pranav-IIITM wants to merge 1 commit into
goharbor:mainfrom
Pranav-IIITM:fix/add-noopener-noreferrer
Open

fix: add rel='noopener noreferrer' to external links#729
Pranav-IIITM wants to merge 1 commit into
goharbor:mainfrom
Pranav-IIITM:fix/add-noopener-noreferrer

Conversation

@Pranav-IIITM

Copy link
Copy Markdown

Summary

All external links using target="_blank" across the site's partials were missing the rel="noopener noreferrer" attribute, exposing the site to reverse tabnapping attacks and minor performance issues. This PR fixes all affected files.

Closes #726

Changes Made

Added rel="noopener noreferrer" to all target="_blank" links in the following files:

  • layouts/partials/social-buttons.html — GitHub, Twitter, Slack links
  • layouts/partials/navbar.html — External top menu links
  • layouts/partials/home/hero.html — Download releases button
  • layouts/partials/home/project.html — Community link
  • layouts/partials/footer.html — GitHub, Status Page, Logos, Slack, Twitter, CC-BY-4.0 License, The Linux Foundation, Trademark Usage links
  • layouts/partials/docs/sidebar.html — GitHub source & issues links
  • layouts/partials/cli-docs/sidebar.html — GitHub source & issues links
  • layouts/partials/blog/posts.html — External blog links

Before & After

Before

<a href="https://example.com" target="_blank">Link</a>

After

<a href="https://example.com" target="_blank" rel="noopener noreferrer">Link</a>

Why It Matters

  • Security — Prevents reverse tabnapping attacks where a newly opened tab could access window.opener and redirect the original page to a malicious URL
  • Privacynoreferrer stops the browser from sending the Referer header, preventing the origin URL from leaking to external sites
  • Performancenoopener ensures the new tab runs in a separate process, improving performance in some browsers

References

Checklist

  • All target="_blank" links now include rel="noopener noreferrer"
  • No existing functionality or styling affected
  • Changes verified across all affected partials

Adds rel='noopener noreferrer' to all target='_blank' links across the site's layout partials to improve security and performance.

Signed-off-by: Pranav-IIITM <jogdandpranav2007@gmail.com>
@Pranav-IIITM

Copy link
Copy Markdown
Author

@zyyw @OrlinVasilev @AllForNothing Please review the PR !!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security] Add rel="noopener noreferrer" to all external links with target="_blank"

4 participants