Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add section about overriding for trusted links #2438

Merged
merged 1 commit into from Oct 12, 2019

Conversation

@aschriner
Copy link
Contributor

commented Oct 2, 2019

No description provided.

…d links
@ljharb ljharb force-pushed the aschriner:patch-1 branch from edb468c to cc26120 Oct 4, 2019
@@ -74,6 +74,9 @@ var Hello = <Link target="_blank" to="/absolute/path/in/the/host"></Link>
var Hello = <Link />
```

## When To Override It
For internal links, or links to a "safe" host, you may want to keep the HTTP Referer header for analytics purposes.

This comment has been minimized.

Copy link
@ljharb

ljharb Oct 4, 2019

Collaborator

can you elaborate on what you mean by "safe"?

This comment has been minimized.

Copy link
@aschriner

aschriner Oct 11, 2019

Author Contributor

I updated with additional text. To elaborate further on the reason for this change: this lint rule and the linked page make it sound like one should never use target="_blank" without noreferer and noopener. However, as I understand, if you control the site to which you are linking, there is no vulnerability. And there are good reasons to keep the referer header (e.g. interal analytics/tracking).

@aschriner aschriner force-pushed the aschriner:patch-1 branch from cc26120 to 2fb6912 Oct 11, 2019
@ljharb
ljharb approved these changes Oct 12, 2019
@ljharb ljharb force-pushed the aschriner:patch-1 branch from 2fb6912 to 0c1cb28 Oct 12, 2019
@ljharb ljharb merged commit 0c1cb28 into yannickcr:master Oct 12, 2019
2 checks passed
2 checks passed
continuous-integration/travis-ci/pr The Travis CI build passed
Details
coverage/coveralls Coverage increased (+0.0006%) to 97.554%
Details
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants
You can’t perform that action at this time.