goharbor / goharbor/website

[Security] Add rel="noopener noreferrer" to all external links with target="_blank"

Open
#726 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
46
Forks
222
PR merge metrics
No merged PRs in 30d

Description

## Description

Throughout the Harbor website, external links are set to open in new tabs using `target="_blank"` but are missing the `rel="noopener noreferrer"` attribute. This is a well-known security vulnerability that allows the newly opened tab to access and potentially manipulate the original tab via the `window.opener` object. It also causes minor performance degradation in some browsers.

## Affected Files

- `layouts/partials/navbar.html`
- `layouts/partials/footer.html`
- `layouts/partials/home/hero.html`
- `layouts/partials/social-buttons.html`

## Current Behavior

External links such as GitHub releases, Twitter, and Linux Foundation links are using `target="_blank"` without the `rel` attribute:

```html

Link
```

## Expected Behavior

All external links with `target="_blank"` should include `rel="noopener noreferrer"`:

```html

Link
```

## Why It Matters

- **Security** — Without `rel="noopener"`, the newly opened tab can access `window.opener` and potentially redirect the original page to a malicious URL (reverse tabnapping attack)
- **Privacy** — `noreferrer` prevents the browser from sending the `Referer` header, avoiding leaking the origin page URL to external sites
- **Performance** — `noopener` prevents the new tab from running in the same process as the original page, improving performance in some browsers

## References

- [MDN Web Docs — Link types: noopener](https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/rel/noopener)
- [web.dev — Links to cross-origin destinations are unsafe](https://web.dev/external-anchors-use-rel-noopener/)

Contributor guide

No contributing guide indexed for this repository

Research direction

Inspect the four named templates: layouts/partials/navbar.html, layouts/partials/footer.html, layouts/partials/home/hero.html, and layouts/partials/social-buttons.html. Search them for external anchors using target="_blank", add the requested rel attribute where missing, and verify that every affected link has the secure attributes before checking the website build or preview.

Written by the indexing model from the issue text.

Assessment

Tech stack
html
Domain
security, web-dev
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.