External links use noopener noreferrer
Why it matters
An external link opened with target='_blank' without rel='noopener' gives the opened page access to window.opener — a reference back to your tab's window object. A malicious destination site (or one compromised via XSS) can call window.opener.location = 'https://phishing-site.com' to silently redirect your tab to a phishing page while the user is reading the opened content. CWE-1021 (Improper Restriction of Rendered UI Layers) applies directly. OWASP A05 lists missing noopener as a common misconfiguration. Modern browsers now default to noopener, but explicit attributes are required for backward compatibility and code-review clarity.
Severity rationale
Low because modern browsers default `target='_blank'` to noopener behavior, but explicit `rel='noopener noreferrer'` is required for older browser compatibility and eliminates referrer leakage to external domains.
Remediation
Add rel='noopener noreferrer' to every <a target='_blank'> pointing to an external domain. The noreferrer attribute also prevents sending your page URL as the HTTP Referer to the destination.
// All external links opening in new tabs
<a
href="https://example.com"
target="_blank"
rel="noopener noreferrer"
>
External Link
</a>
In Next.js, the <Link> component automatically adds rel='noopener' for external links with target='_blank' in recent versions — but noreferrer must still be added manually if you want to suppress Referer headers.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Security Headers II Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-1021
- owasp:2021 · A05
Taxons
History
- 2026-04-18·v1.0.0·Initial import from security-headers-ii·automated