synox / disposable-mailbox

self-hosted disposable email service (php) using catch-all and imap
GNU General Public License v3.0
390 stars 147 forks source link

Remove Referer on clicked links #7

Closed synox closed 7 years ago

synox commented 7 years ago

When a user clicks on a link in a mail, the website can see the "Referer" and can thereby access the users mailbox. This has to be avoided.

Possible solutions:

synox commented 7 years ago

Autolinker.js automatically adds rel="noopener noreferrer" to every link when the option newWindow:true is added. Except IE does not seem to respect it. http://caniuse.com/#feat=referrer-policy