On Thu, Nov 22, 2018 at 10:55 AM Boris Zbarsky <bzbar...@mit.edu> wrote:
> On 11/22/18 1:06 AM, Ehsan Akhgari wrote: > >> Can one do noreferrer with window.open()? > >> > > > > Yes, by passing 'noopener' in the features argument: > > > https://html.spec.whatwg.org/multipage/window-object.html#apis-for-creating-and-navigating-browsing-contexts-by-name:disowned-its-opener > > But we're trying to _have_ an opener; that's why we're here to start > with. We're talking about noreferrer. > My apologies, I misread your previous email as saying "Can one do noopener" :-/ Indeed, specifying noreferrer isn't currently possible. I think that is a desirable feature to add to window.open(). > > Which reminds me, it's impossible to block opener reference creation upon > > form submission right now as far as I can tell. > > Yes. Right now <form> doesn't have a thing like "rel" to pass along > directives like "noopener". Maybe we should get that fixed in the spec > somehow. > Do you mean adding a rel attribute to <form>? Not sure if all of the other link type values for rel make sense for <form> but having some way of passing "noopener" (and "opener" for that matter) directives for <form> is indeed something that we should probably look into doing, especially when it comes to changing the default behavior of <form target=_blank>. I have no good ideas for how to do it other than inventing yet a new attribute... > > I wonder if it makes sense to make a similar change here, to make <form > > target="_blank"> imply noopener behaviour and then if that proves to be > Web > > compatible, propose to change the spec to pass false there? > > It might indeed. > Talked to baku and annevk a bit also, and I guess there is one way to know the web compat impact, so I filed https://bugzilla.mozilla.org/show_bug.cgi?id=1509346. Cheers, -- Ehsan _______________________________________________ dev-platform mailing list dev-platform@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-platform
