search

privacycg / private-click-measurement

Private Click Measurement
https://privacycg.github.io/private-click-measurement/
198 stars 8 forks source link

Require noopener in links and window.open() #94

Open johnwilander opened 2 years ago

johnwilander commented 2 years ago

We should require links to have rel="noopener" and window.open() be called with the noopener window feature to make sure that there is no covert, cross-site communication channel back to the opener over which tracking information can be sent.

Ping @csharrison and @johnivdel for consideration in Attribution Reporting API.

SOV37 commented 2 years ago

Dawn

annevk commented 2 years ago

It might be simpler to default to noopener if the attribution attributes are present? Similar to target=_blank, except you would not allow it to be overridden.

johnwilander commented 2 years ago

It might be simpler to default to noopener if the attribution attributes are present? Similar to target=_blank, except you would not allow it to be overridden.

I had the same thought some time after filing this. Requiring the developer to opt in to noopener makes it explicit and known to them instead of implicit and a side effect. I could go either way.

AramZS commented 2 years ago

I agree, defaulting to noopener mode makes the most sense to me if that's the way the system is intended to work. Long term it seems to me that if it is always active, which I think is what we are discussing here(?), then having to add it as a property to every use seems to be messy?

csharrison commented 2 years ago

Sorry I missed this originally. This seems reasonable to me, and I can also bring it up in the attribution reporting api WICG meeting next week.

npdoty commented 2 years ago

in either approach, how will/should the developer learn why something is broken? does one way make it easier to put a debug warning into the console?

csharrison commented 2 years ago

in either approach, how will/should the developer learn why something is broken? does one way make it easier to put a debug warning into the console?

I think either case should be easy to signal to developers with a console error.