Does Pale Moon have support for the rel="noopener" attribute? Topic is solved

[half-moon]

Does Pale Moon have support for the rel="noopener" attribute? It would certainly improve browser security if it does.

[Andrew Gilbertson]

Does Pale Moon have support for the rel="noopener" attribute? It would certainly improve browser security if it does.

I found this page describing the feature: https://mathiasbynens.github.io/rel-noopener/

The problem with this is that you'd have to apply this to every link on the web...except those that you actually want to have control over other tabs/windows, which then leads to potential issues with managing lists (whether that's whitelists, blacklists, or graylists depends on the implementation). I'm not going to go so far as to say that this is a bad idea, but I will say that it sounds like a good candidate for being handled by an extension that will either block these types of requests, or prompt to allow them, rather than being a core browser feature. And it turns out that there are already extensions that handle it: NoScript blocks this and Request Policy Continued prompts whether or not to allow the redirect.

[0strodamus]

As far as I can tell, Noscript 2.9.0.14 doesn't block this if you allow scripts on https://mathiasbynens.github.io and/or https://mathiasbynens.be. RequestPolicy also obviously isn't detecting the same-origin tab manipulation at all. Because other modern browsers are implementing changes to mitigate this, I filed an Issue and hopefully this is something Pale Moon can implement too.

This noopener_by_default userscript is working for me in Pale Moon as tested on https://mathiasbynens.github.io/rel-noopener/.

[0strodamus]

According to Moonchild, Pale Moon does already have support for the rel="noopener" attribute.

[half-moon]

ok, thanks man.

[GreenGeek]

OK, I've been reading quite a bit about this on several sites but mostly starting from ghacksuserjs on github. It seems to me (but I could be wrong) that we are talking about two different aspects of the issue. Pale Moon has support for rel=noopener but that has to be added to a link by the website author, correct? Whereas the point of an extension or script is to add it without depending on the webmaster who posts the link on his page. If I have this correct we still need a script or extension to take full advantage of the support for it that PM has by adding it to links the webmasters didn't.

[Moonchild]

It is up to the webmasters to add this property to links if they do not want the linked site to have control over their page.
This is entirely to protect the webmaster's site (prevent opener navigation control) - nothing else.

[0strodamus]

If I have this correct we still need a script or extension to take full advantage of the support for it that PM has by adding it to links the webmasters didn't.

I would say yes and I have been using the Disable Targets userscript from legroom.net.