Skip to content

Consider removing @eslint-react/dom/no-unsafe-target-blank from recommended #1262

@jdufresne

Description

@jdufresne

According to caniuse, all modern browsers now treat target="_blank" as if rel="noopener" were set. MDN confirms this as well:

Setting target="_blank" on <a>, <area>, and <form> elements implicitly provides the same behavior as rel="noopener", meaning window.opener is not set.

Given this, it seems that the current rule may be based on assumptions about outdated browser behavior. As a result, the recommendation may now create more friction for users than actual security benefit.

I realize this is easy to disable locally, and I will do so for my setup. I just wanted to raise the point upstream in case it’s of interest. If not, feel free to close this issue without further action.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Status: TriagingIssue is still being evaluated. PRs not yet accepted.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions