Every link in the theme that opens in a new tab uses target="_blank" with no rel hardening. There are seven of them in layout.html and none carries noopener or noreferrer:
| Line |
Link |
| 266, 268, 270 |
author byline links |
| 284 |
translator byline link |
| 408, 410 |
toolbar "View Source" links |
| 471 |
"Launch Notebook" button |
Why this is low urgency but still worth doing
Reverse-tabnabbing is the classic reason to add rel="noopener", and it is not actually exploitable here: every browser released since roughly 2021 (Chrome 88+, Firefox 79+, Safari 12.1+) implies noopener for target="_blank" automatically. So this is defence in depth and a way to satisfy security linters, not a live vulnerability.
It is worth doing as one sweep rather than piecemeal, so the template is internally consistent — hardening one byline link while the one directly above it stays bare is worse than either doing all of them or none.
One decision to make
noopener is uncontroversial. noreferrer is not quite: it also strips the Referer header, so author and translator sites lose referrer attribution in their analytics, and the QuantEcon books are exactly the sort of place an author might care about that. Worth deciding explicitly whether the byline links get noopener alone and the toolbar/launch links get both, or whether all seven get both.
Note the byline links already carry rel="author" (authors only), so the added tokens go in the same space-separated list rather than a second attribute.
Raised by Copilot on #427, where it was deliberately deferred rather than fixed in a feature PR: three of the four byline links are pre-existing markup that PR only added rel="author" to, and fixing three of seven would have left the template inconsistent.
Every link in the theme that opens in a new tab uses
target="_blank"with norelhardening. There are seven of them inlayout.htmland none carriesnoopenerornoreferrer:Why this is low urgency but still worth doing
Reverse-tabnabbing is the classic reason to add
rel="noopener", and it is not actually exploitable here: every browser released since roughly 2021 (Chrome 88+, Firefox 79+, Safari 12.1+) impliesnoopenerfortarget="_blank"automatically. So this is defence in depth and a way to satisfy security linters, not a live vulnerability.It is worth doing as one sweep rather than piecemeal, so the template is internally consistent — hardening one byline link while the one directly above it stays bare is worse than either doing all of them or none.
One decision to make
noopeneris uncontroversial.noreferreris not quite: it also strips theRefererheader, so author and translator sites lose referrer attribution in their analytics, and the QuantEcon books are exactly the sort of place an author might care about that. Worth deciding explicitly whether the byline links getnoopeneralone and the toolbar/launch links get both, or whether all seven get both.Note the byline links already carry
rel="author"(authors only), so the added tokens go in the same space-separated list rather than a second attribute.Raised by Copilot on #427, where it was deliberately deferred rather than fixed in a feature PR: three of the four byline links are pre-existing markup that PR only added
rel="author"to, and fixing three of seven would have left the template inconsistent.