Feature proposal: opener

[clelland]

Raised in whatwg/html#2122 (comment), it might be possible to put a noopener policy into FP; rather than insisting that developers annotate every <a> tag. Something like:

{"opener": ["self", "https://friendly-domain.com"]}

would make any links in the current page, except those to the whitelisted domains, behave as if the rel=noopener attribute was added.

This may be an abuse of the whitelist; we've only used it for policy propagation, rather than selectively changing behaviour of parts of the current document, but it might be worth discussing.

(Possibly another interesting thing about making this part of FP is that we could apply it to windows created with window.open as well, which isn't possible with an attribute on <a>.)

[zcorpan]

Please see w3c/webappsec#139

[annevk]

This is whatwg/html#3740 now.