search

casbin / casbin-hub

The hub for Casbin
https://dashboard.casbin.com
Apache License 2.0
88 stars 46 forks source link

Target blank vulnerability issue #34

Closed shakti97 closed 4 years ago

shakti97 commented 4 years ago

Current Behaviour

Links with target="_blank" on them are vulnerable to having the referrer page being swapped out in the background while the user's attention is diverted by the newly-opened tab. This is known as reverse tabnapping.

Expected Behaviour

Adding rel="noopener noreferrer" to links protects your site's users against having the site you've linked to potentially hijacking the browser (via rogue JS).

More Info:- https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/

shakti97 commented 4 years ago

@hsluoyz if possible , I would love to work on this:)