The 1.7 release notes mention that noreferrer was added. I don’t see it in the options or in the codebase anywhere. I categorized this as support, because maybe i’m missing the config somewhere? But maybe it’s a bug? [image]Discourse Version 1.7 Add rel noopener and noreferrer in addition to nofollow

This can be achieved quite easily with a theme component if someone really wants this.

It has been removed a while ago do not add rel noreferrer committed 12:49PM - 20 Nov 16 UTC (UTC) [image] arpitjalan +16 -16 @techAPJ do you remember why?

I vaguely remember, mostly I think because it is pointless? noopener is for security nofollow is for search engine safety noreferrer .. has no purpose other than “screw you, we’re not sending the referrer” .. plus http to https doesn’t send it anyway. There is a pretty weak case to be made for it in terms of intranet leakage, but I would be unwilling to spend any engineering time on this unless a few paying customers request it.

Sorry, I can’t remember exactly why I removed it. There must be a discussion for it here on meta but I am unable to find it right now.

Speaking of referrers Preventing data leaks by stripping path information in HTTP Referrers –... Starting in version 59, Firefox Private Browsing will remove path data from Referrers sent to third parties. This will help prevent accidentally leaking data to third parties. Est. reading time: 3 minutes

For a dynamic web app like Discourse, referer policy is probably more useful to be set at a page scope rather than for individual links. To dynamically set referer policy, use the element, and the last set policy prevails, which makes it very easy to code. An example policy: " no-referrer-when-downgrade " by default " strict-origin-when-cross-origin " when viewing private messages or secure categories With a site setting to change it to always be “strict-origin-when-cross-origin”, turned on by default for login required sites. If we decide Discourse doesn’t need its own referer information, strict-when-cro can be upgraded to “strict-origin” to save bandwidth.

I’m curious, why is rel="noopener" added in oneboxes but not normal external links? [58] [22] They also seem to be missing in the user-card.

Possibly an oversight cc @techapj

[image] frictionel: why is rel=“noopener” added in oneboxes but not normal external links? rel="noopener" not being added in normal external links is actually correct behaviour because @codinghorror is TL4 and tl3 links no follow is disabled. rel="nofollow noopener" being added for @zogstrip (TL4) is a bug and onebox should respect the site setting tl3 links no follow. There is a bug report for this here: [image] Is there a way to remove nofollow from onebox Bug Continuing the discussion from "exclude rel nofollow domains" not respected inside of onebox: It seems that even after whitelisting a website, onebox nofollows every link, including internal. [image] frictionel: They also seem to be missing in the user-card. If the user is TL3 or above, rel="nofollow noopener" not being present is correct / as expected.

[image] techAPJ: rel=“nofollow noopener” being added for @zogstrip (TL4) is a bug and onebox should respect the site setting tl3 links no follow. Fixed via: https://github.com/discourse/discourse/commit/b75b6de982013fdfd08b8aecb1c701b35c787599

This seems to be a no-brainer: Why not trust a link that someone posted who is trusted by Discourse? But I was thinking about it a little more and this is the wrong question. How can you or @codinghorror or anyone be certain that the external site isn’t compromised? And if not now can’t it be malicious at some point in the future? So it’s not about trusting the user who posted the link but rather trusting the target site. Tell me that i’m wrong.

Optionally add noreferrer to external links

Product Support

frictionel March 25, 2018, 3:30pm 8

I’m curious, why is rel="noopener" added in oneboxes but not normal external links?

They also seem to be missing in the user-card.

Topic		Replies	Views
Option to remove the referrer for external links Feature	4	1037	May 18, 2022
How to anonymize your links in Discourse? Product Support	31	7743	December 31, 2016
Cloak/mask outgoing links? Product Support	1	1153	August 30, 2016
Is there a way to remove nofollow from onebox Bug	5	1191	March 26, 2018
Nofollow link is not working in oneboxes Feature	1	809	December 6, 2016

Optionally add noreferrer to external links

Related topics