[Security] Add rel="noopener noreferrer" to all external links with target="_blank"
- Dominant language
- HTML
- Stars
- 46
- Forks
- 222
- PR merge metrics
- No merged PRs in 30d
Description
## Description
Throughout the Harbor website, external links are set to open in new tabs using `target="_blank"` but are missing the `rel="noopener noreferrer"` attribute. This is a well-known security vulnerability that allows the newly opened tab to access and potentially manipulate the original tab via the `window.opener` object. It also causes minor performance degradation in some browsers.
## Affected Files
- `layouts/partials/navbar.html`
- `layouts/partials/footer.html`
- `layouts/partials/home/hero.html`
- `layouts/partials/social-buttons.html`
## Current Behavior
External links such as GitHub releases, Twitter, and Linux Foundation links are using `target="_blank"` without the `rel` attribute:
```html
Link
```
## Expected Behavior
All external links with `target="_blank"` should include `rel="noopener noreferrer"`:
```html
Link
```
## Why It Matters
- **Security** — Without `rel="noopener"`, the newly opened tab can access `window.opener` and potentially redirect the original page to a malicious URL (reverse tabnapping attack)
- **Privacy** — `noreferrer` prevents the browser from sending the `Referer` header, avoiding leaking the origin page URL to external sites
- **Performance** — `noopener` prevents the new tab from running in the same process as the original page, improving performance in some browsers
## References
- [MDN Web Docs — Link types: noopener](https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/rel/noopener)
- [web.dev — Links to cross-origin destinations are unsafe](https://web.dev/external-anchors-use-rel-noopener/)
Contributor guide
No contributing guide indexed for this repository
Research direction
Inspect the four named templates: layouts/partials/navbar.html, layouts/partials/footer.html, layouts/partials/home/hero.html, and layouts/partials/social-buttons.html. Search them for external anchors using target="_blank", add the requested rel attribute where missing, and verify that every affected link has the secure attributes before checking the website build or preview.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 58/100