diff --git a/files/en-us/web/api/window/opener/index.html b/files/en-us/web/api/window/opener/index.html index f15ebfff2a1ecb5..9b2388af0461209 100644 --- a/files/en-us/web/api/window/opener/index.html +++ b/files/en-us/web/api/window/opener/index.html @@ -47,7 +47,7 @@
{{htmlattrxref("rel", "a")}}=noopener
on a link, or passing
noopener
in the {{domxref("Window.open", "windowFeatures")}} parameter.
- _blank
don't get an opener
, unless explicitly
requested with {{htmlattrxref("rel", "a")}}=opener
./
and \
characters are converted to underscores (_
). Filesystems may forbid other characters in filenames, so browsers will adjust the suggested name if necessary.download
only works for same-origin URLs, or the blob:
and data:
schemes.Note: if the Content-Disposition
header has different information from the download
attribute, resulting behavior may differ:
If the Content-Disposition
header has different information from the download
attribute, resulting behavior may differ:
_top
: the topmost browsing context (the "highest" context that’s an ancestor of the current one). If no ancestors, behaves as _self
.Note: When using target
, add rel="noreferrer noopener"
to avoid exploitation of the window.opener
API.
Note: In newer browser versions (e.g. Firefox 79+) setting target="_blank"
on <a>
elements implicitly provides the same rel
behavior as setting rel="noopener"
.
Setting target="_blank"
on <a>
elements implicitly provides the same rel
behavior as setting rel="noopener"
which does not set window.opener
. See browser compatibility for support status.
Note: This attribute is obsolete and should not be used by authors. Use the HTTP {{HTTPHeader("Content-Type")}} header on the linked URL.
+This attribute is obsolete and should not be used by authors. Use the HTTP {{HTTPHeader("Content-Type")}} header on the linked URL.
shape
attribute. A comma-separated list of coordinates.id
and name
could both be used on <a>
, as long as they had identical values.
- Note: Use the global attribute {{HTMLAttrxRef("id")}} instead.
+Use the global attribute {{HTMLAttrxRef("id")}} instead.
rel
attribute. Deprecated for being very confusing.Use the {{HTMLElement("area")}} element for image maps instead.
+Note: You can use href="#top"
or the empty fragment (href="#"
) to link to the top of the current page, as defined in the HTML specification.
You can use href="#top"
or the empty fragment (href="#"
) to link to the top of the current page, as defined in the HTML specification.
<a>
elements can have consequences for users’ security and privacy. See Referer
header: privacy and security concerns for information.
Using target="_blank"
without rel="noreferrer"
and rel="noopener"
makes the website vulnerable to {{domxref("window.opener")}} API exploitation attacks (vulnerability description), although note that, in newer browser versions (e.g. Firefox 79+) setting target="_blank"
implicitly provides the same protection as setting rel="noopener"
.
Using target="_blank"
without rel="noreferrer"
and rel="noopener"
makes the website vulnerable to {{domxref("window.opener")}} API exploitation attacks (vulnerability description), although note that, in newer browser versions setting target="_blank"
implicitly provides the same protection as setting rel="noopener"
. See browser compatibility for details.
Note: In newer browser versions (e.g. Firefox 79+) setting target="_blank"
on <area>
elements implicitly provides the same rel
behavior as setting rel="noopener"
.
Setting target="_blank"
on <area>
elements implicitly provides the same rel
behavior as setting rel="noopener"
which does not set window.opener
. See browser compatibility for support status.
Note: Since HTML5, omitting the href
attribute is sufficient.
Since HTML5, omitting the href
attribute is sufficient.
This element includes the global attributes.
<input type=file>
elements.This attribute was removed in HTML5 and should not be used. Instead, use the {{htmlattrxref("accept", "input")}} attribute on <input type=file>
elements.
This value can be overridden by a {{htmlattrxref("formtarget", "button")}} attribute on a {{HTMLElement("button")}}, <input type="submit">
, or <input type="image">
element.
Setting target="_blank"
on <form>
elements implicitly provides the same rel
behavior as setting rel="noopener"
which does not set window.opener
.