# My build a tribute page project

**URL:** <https://forum.freecodecamp.org/t/my-build-a-tribute-page-project/159847>\
**Category:** I Built This\
**Created:** [November 19, 2017, 1:04pm UTC](https://forum.freecodecamp.org/t/my-build-a-tribute-page-project/159847 "2017-11-19T13:04:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cassin4996](https://avatars.discourse-cdn.com/v4/letter/c/8dc957/32.png) [@Cassin4996](https://forum.freecodecamp.org/u/Cassin4996)\
**Post date:** [November 19, 2017, 1:04pm UTC](https://forum.freecodecamp.org/t/my-build-a-tribute-page-project/159847/1 "2017-11-19T13:04:37Z")

</div>

> **[Cassin](https://codepen.io/cassin/pen/LOeBao)**
>
> ...

Please review it.

---

<div class="post-metadata">

**Author:** ![Diego\_Perez](https://avatars.discourse-cdn.com/v4/letter/d/f07891/32.png) [@Diego\_Perez](https://forum.freecodecamp.org/u/Diego_Perez)\
**Post date:** [November 20, 2017, 1:51pm UTC](https://forum.freecodecamp.org/t/my-build-a-tribute-page-project/159847/2 "2017-11-20T13:51:24Z")

</div>

Hi @Cassin4996,

- Target blank vulnerability

```html
<a href="https://www.linkedin.com/in/cassin-thangam-e-64057b126/" target="_blank">

```

MDN documentation:

[\<a\>: The Anchor element - HTML: HyperText Markup Language | MDN](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a)

> Note: When using target, consider _adding rel=“noopener noreferrer”_  
> _to avoid exploitation of the window.opener API._

[About rel=noopener](https://mathiasbynens.github.io/rel-noopener/)

> TL;DR If window.opener is set, a page can trigger a navigation in the opener regardless of security origin.

[Target="\_blank" - the most underestimated vulnerability ever](https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/)

> People using target=‘\_blank’ links usually have no idea about this curious fact:  
> The page we’re linking to gains partial access to the linking page via the window.opener object.  
> The newly opened tab can, say, change the window.opener.location to some phishing page. Or execute some JavaScript on the opener-page on your behalf… Users trust the page that is already opened, they won’t get suspicious.

> How to fix  
> Add this to your outgoing links.

`rel="noopener"`

> Update: FF does not support “noopener” so add this.

`rel="noopener noreferrer"`

> Remember, that every time you open a new window via window.open(); you’re also “vulnerable” to this, so always reset the “opener” property

```javascript
var newWnd = window.open();
newWnd.opener = null;

```

- A typo (html, line 9):

```html
<>

```

Cheers and happy coding 🙂

---

<div class="post-metadata">

**Author:** ![Cassin4996](https://avatars.discourse-cdn.com/v4/letter/c/8dc957/32.png) [@Cassin4996](https://forum.freecodecamp.org/u/Cassin4996)\
**Post date:** [November 20, 2017, 2:51pm UTC](https://forum.freecodecamp.org/t/my-build-a-tribute-page-project/159847/3 "2017-11-20T14:51:12Z")

</div>

> [@Diego\_Perez](#):
>
> mber, that every time you open a new win

Thanks man. I’ll do it.

---

<div class="post-metadata">

**Author:** ![ILM](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/ilm/32/363239_2.png) [@ILM](https://forum.freecodecamp.org/u/ILM)\
**Post date:** [June 1, 2021, 2:26pm UTC](https://forum.freecodecamp.org/t/my-build-a-tribute-page-project/159847/4 "2021-06-01T14:26:31Z")

</div>

Closed on June 1, 2021, 2:26pm UTC