All rules

Sheath rule

security-no-target-blank

Prevent target="_blank" links from retaining access to window.opener.
Package
Core
Category
Security
Default severity
warning by default
Auto-fix
Auto-fix available

#Why

Current HTML behavior gives _blank links implicit noopener protection unless the link explicitly opts back in with rel="opener". An opened page that retains a window.opener handle can navigate the original tab, a technique known as reverse tabnabbing.

rel="noopener" withholds the handle. rel="noreferrer" withholds it and the Referer header.

#Examples

#Bad

<!-- Explicitly restores window.opener access -->

<a href="https://example.com" target="_blank" rel="opener">External Link</a>



<!-- Image-map links are hyperlinks too -->

<area href="https://example.com" target="_blank" rel="opener">

#Good

<!-- Current HTML semantics provide implicit noopener -->

<a href="https://example.com" target="_blank">Link</a>



<!-- Explicit noopener is also valid -->

<a href="https://example.com" target="_blank" rel="noopener">Link</a>



<!-- noreferrer additionally suppresses the referrer -->

<a href="https://example.com" target="_blank" rel="noreferrer">Link</a>

#Legacy-Browser Compatibility

Projects supporting browsers that predate implicit _blank protection can require an explicit token:

<?php



'security-no-target-blank' => ['warning', [

    'requireExplicitNoopener' => true,

]],
Option Type Default Description
requireExplicitNoopener boolean false Require noopener or noreferrer even when current HTML semantics provide it implicitly

With this option enabled, a missing, empty, unrelated, or runtime-dynamic rel value is reported because the template cannot prove that a legacy browser will receive an explicit safe token.

#Auto-fix

For rel="opener", the fixer appends noopener:

<!-- Before -->

<a href="https://example.com" target="_blank" rel="opener">Link</a>



<!-- After -->

<a href="https://example.com" target="_blank" rel="opener noopener">Link</a>

In legacy mode it also adds or appends noopener when the token is absent. The fixer does not add noreferrer, so referrer and analytics behavior are preserved.

#Notes

  • Both <a> and <area> hyperlinks are checked.
  • Dynamic target values are left for runtime.
  • Dynamic rel values are left for runtime under the default current-browser policy.

#References

#Related Rules