no-unsafe-target-blank

Full Name in eslint-plugin-react-dom

react-dom/no-unsafe-target-blank

Full Name in @eslint-react/eslint-plugin

@eslint-react/dom-no-unsafe-target-blank

Features

⚙️ 🔧

Presets

strict strict-typescript strict-type-checked

Rule DetailsCopy Anchor Link

When using target="_blank" on links without rel="noreferrer noopener", the opened page could historically access the window.opener property of the original page, a security vulnerability known as tabnabbing. Modern browsers (Chrome 88+, Firefox 79+, Safari 12.1+) now implicitly treat target="_blank" as rel="noopener", so window.opener is no longer accessible. Explicitly adding rel="noreferrer" is still recommended: it covers older browsers and also hides the Referer header from the linked page, which improves privacy.

ExamplesCopy Anchor Link

Opening external links in a new tabCopy Anchor Link

function MyComponent() {
  return (
    // 🔴 Problem: target="_blank" without rel relies on the browser's implicit noopener
    // and leaks the Referer header to the linked page
    <a href="https://eslint-react.xyz" target="_blank">
      Example
    </a>
  );
}

function MyComponent() {
  return (
    // 🟢 Recommended: Always add rel="noreferrer noopener" when using target="_blank"
    <a href="https://eslint-react.xyz" target="_blank" rel="noreferrer noopener">
      Example
    </a>
  );
}

OptionsCopy Anchor Link

Rule OptionsCopy Anchor Link

type Options = {
  allowReferrer?: boolean; // default: false
};

allowReferrerCopy Anchor Link

When set to true, rel="noopener" alone is accepted and the suggested fix adds rel="noopener" instead of rel="noreferrer noopener". This preserves the Referer header while still requiring an explicit token that prevents tabnabbing.

Default: false

ResourcesCopy Anchor Link

• Rule Source
• Test Source
• Rule Changelog

Further ReadingCopy Anchor Link

• MDN: target
• MDN: rel
• MDN: Window.opener

See AlsoCopy Anchor Link

• react-dom/no-unsafe-iframe-sandbox
  Enforces that the sandbox attribute for iframe elements is not set to unsafe combinations.