adobe / adobe/aem-core-wcm-components

[Link] Add a noopener attribute on external link

Open
#2,902 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
795
Forks
775
Avg merge
3d 22h
Merged PRs (30d)
8

Description

## Feature Request

**Is your feature request related to a problem? Please describe.**
We don't use the rel="noopener" attribute on all our external links. A recent audit reports that we should add it to avoid security issues.

**Describe the solution you'd like**
It would be great to add automatically the rel attribute like :
`Label`

**Noopener**
- How it works: When using target="_blank" to open a link in a new tab, the linked page may partially navigate to the original page via window.opener, which can be exploited for **phishing attacks**. The rel="noopener" attribute prevents this behavior by telling the browser not to set window.opener, thereby protecting the original page.
- Usage: When a link is opened in a new tab with target="_blank".

**Noreferrer**
- How it works: Similar to noopener, it prevents the opened site from manipulating window.opener and prevents the browser from sending the referring page address.
- Use: For external **no-trusted** links.
- Impact: On statistics, it can distort the data by reporting more direct traffic.

**Documentation**
- WCAG G201 https://www.w3.org/WAI/WCAG22/Techniques/general/G201.html
- https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/rel/noopener
- https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/rel/noreferrer

Contributor guide

Open the contributing guide

Research direction

No source file or test is identified in the issue. Start by locating the component code that renders external links, then verify links opened with target="_blank" include the requested rel attributes without changing trusted-link behavior; add or update coverage for the rendered markup.

Written by the indexing model from the issue text.

Assessment

Tech stack
html
Domain
frontend, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.