Skip to content

Fix reverse tab-nabbing vulnerability in external links #182

@KalebJG

Description

@KalebJG

What happened?

External links using target="_blank" without the rel attribute create a security vulnerability that allows opened pages to manipulate the parent window through window.opener. This can lead to reverse tab-nabbing attacks where malicious sites redirect users to phishing pages.

// Before

// After

Replication Steps

  1. Navigate to apps/marketing/src/app/layout.tsx
  2. Go to line 112
  3. Observe the Link component with target="_blank" but missing rel attribute

Self hosted or Cloud?

Self hosted

What browsers are you seeing the problem on?

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions