Reduce the risk of falling victim to phishing attacks.
Any website that uses target="_blank" on their links, allows user generated content and doesn't use the rel="noopener" attribute on their links (I'm looking at you Facebook, Twitter etc.) is vulnerable to a scarily simple phishing attack. For an example of this kind of attack, view this example that I've made: https://jamiefarrelly.github.io/Rel-NoOpener-Example/ This Chrome extension is as simple as it gets, all it does is add "noopener noreferrer" to the rel attribute on all links on the pages that you're visiting so that you won't fall victim to this type of phishing attack. Open source on Github https://github.com/JamieFarrelly/No-Opener-No-Phishers
- (2020-01-29) Robert Stewart: Simple and effective. Successfully tested at https://mathiasbynens.github.io/rel-noopener/ in Vivaldi 2.10.1745.27 (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.131 Safari/537.36).
- (2019-07-18) Lecoin Names: works fine and nice extension!
- (2019-06-10) Dan Atkinson: This does exactly what you'd want and expect it to do. The actual code is a single line of JS to simply add the 'noopener', and 'noreferrer' attributes to all links with a target of _blank. It's a clean and simple extension that should be baked directly into Chrome itself.
- (2018-01-18) DBS MGMT: It does what it says. You can check (and better understand) its effectiveness on this website: https://mathiasbynens.github.io/rel-noopener/ Thanks Jamie.
- (2017-10-13) Thanks Jamie! Glad to have this protection in Chrome.
- (2020-08-01, v:2) Steve Graham: Feature Request: Site Whitelist
I've got a site I use daily (my email client) and I would love to have a simple whitelist feature. If possible, it would also be awesome to see a console.log of what the site tries to use the noopener for (or maybe the link that causes the issue). I know that is a lot more work, so don't worry about it much; the above issue (whitelist) would be phenomenal! Thanks for your work so far!
- (2018-02-07, v:1) Ryan Freeman: Preserve existing REL value
The extension replaces the existing rel="" value, which causes some functionality problems. The FB notifications link has rel="toggle", but that is removed when the extension is active. If the extension could be coded to preserve the existing REL values (except those that directly conflict with the ones added by the extension) it would be really helpful. Thanks!
- (2016-09-01, v:1) John-Robin Tell: Facebook
The extension breaks facebook. With it activated you won't be able to open your notifications list, friend requests and messages at the top right of the page.