# Feedback on my Tribute Page - Jacob P

**URL:** <https://forum.freecodecamp.org/t/feedback-on-my-tribute-page-jacob-p/164054>\
**Category:** I Built This\
**Created:** [December 16, 2017, 6:24pm UTC](https://forum.freecodecamp.org/t/feedback-on-my-tribute-page-jacob-p/164054 "2017-12-16T18:24:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![JacobPie1](https://avatars.discourse-cdn.com/v4/letter/j/67e7ee/32.png) [@JacobPie1](https://forum.freecodecamp.org/u/JacobPie1)\
**Post date:** [December 16, 2017, 6:24pm UTC](https://forum.freecodecamp.org/t/feedback-on-my-tribute-page-jacob-p/164054/1 "2017-12-16T18:24:59Z")

</div>

Hello! My name is Jacob and I am asking for any feedback on my tribute page. Any help is great. Thanks!

> **[Tribute Page - FreeCodeCamp](https://codepen.io/JakePie/full/vpNRrb/)**
>
> ...

---

<div class="post-metadata">

**Author:** ![Diego\_Perez](https://avatars.discourse-cdn.com/v4/letter/d/f07891/32.png) [@Diego\_Perez](https://forum.freecodecamp.org/u/Diego_Perez)\
**Post date:** [December 18, 2017, 10:09pm UTC](https://forum.freecodecamp.org/t/feedback-on-my-tribute-page-jacob-p/164054/2 "2017-12-18T22:09:07Z")

</div>

Hi @JacobPie1,

- Target blank vulnerability

```html
<a href="http://www.history.com/topics/american-civil-war/abner-doubleday" target="_blank">here.</a>

```

MDN documentation:

[\<a\>: The Anchor element - HTML: HyperText Markup Language | MDN](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a)

> Note: When using target, consider _adding rel=“noopener noreferrer”_  
> _to avoid exploitation of the window.opener API._

[About rel=noopener](https://mathiasbynens.github.io/rel-noopener/)

> TL;DR If window.opener is set, a page can trigger a navigation in the opener regardless of security origin.

[Target="\_blank" - the most underestimated vulnerability ever](https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/)

> People using target=‘\_blank’ links usually have no idea about this curious fact:  
> The page we’re linking to gains partial access to the linking page via the window.opener object.  
> The newly opened tab can, say, change the window.opener.location to some phishing page. Or execute some JavaScript on the opener-page on your behalf… Users trust the page that is already opened, they won’t get suspicious.

> How to fix  
> Add this to your outgoing links.

`rel="noopener"`

> Update: FF does not support “noopener” so add this.

`rel="noopener noreferrer"`

> Remember, that every time you open a new window via window.open(); you’re also “vulnerable” to this, so always reset the “opener” property

```javascript
var newWnd = window.open();
newWnd.opener = null;

```

Cheers and happy coding 🙂

---

<div class="post-metadata">

**Author:** ![ILM](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/ilm/32/363239_2.png) [@ILM](https://forum.freecodecamp.org/u/ILM)\
**Post date:** [June 1, 2021, 1:56pm UTC](https://forum.freecodecamp.org/t/feedback-on-my-tribute-page-jacob-p/164054/3 "2021-06-01T13:56:49Z")

</div>

Closed on June 1, 2021, 1:56pm UTC