# 可选地为外部链接添加 noreferrer **URL:** \ **Category:** Support\ **Created:** [2018年一月31日 17:34 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474 "2018-01-31T17:34:41Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![brett\_zink](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/brett_zink/32/182335_2.png) [@brett\_zink](https://meta.discourse.org/u/brett_zink)\ **Post date:** [2018年一月31日 17:34 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474/1 "2018-01-31T17:34:41Z")
The 1.7 release notes mention that noreferrer was added. I don’t see it in the options or in the codebase anywhere. I categorized this as support, because maybe i’m missing the config somewhere? But maybe it’s a bug? > [@Discourse Version 1.7](https://meta.discourse.org/t/discourse-version-1-7/41842/5): > > Add rel noopener and noreferrer in addition to nofollow ---
**Author:** ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)\ **Post date:** [2018年一月31日 20:19 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474/2 "2018-01-31T20:19:44Z")
It has been removed a while ago > @techAPJ do you remember why? ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2018年二月1日 00:31 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474/3 "2018-02-01T00:31:52Z")
I vaguely remember, mostly I think because it is pointless? - `noopener` is [for security](https://mathiasbynens.github.io/rel-noopener/) - `nofollow` is [for search engine safety](https://searchengineland.com/infographic-nofollow-tag-172157) - `noreferrer` .. has no _purpose_ other than “screw you, we’re not sending the referrer” .. plus http to https doesn’t send it anyway. There is a pretty weak case to be made for it in terms of intranet leakage, but I would be unwilling to spend any engineering time on this unless a few paying customers request it. ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [2018年二月1日 05:04 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474/4 "2018-02-01T05:04:28Z")
This can be achieved quite easily with a theme component if someone really wants this. ---
**Author:** ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)\ **Post date:** [2018年二月1日 10:15 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474/5 "2018-02-01T10:15:54Z")
Sorry, I can’t remember exactly why I removed it. There must be a discussion for it here on meta but I am unable to find it right now. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2018年二月2日 05:06 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474/6 "2018-02-02T05:06:51Z")
Speaking of referrers > **[Preventing data leaks by stripping path information in HTTP Referrers –...](https://blog.mozilla.org/security/2018/01/31/preventing-data-leaks-by-stripping-path-information-in-http-referrers/)** > > Starting in version 59, Firefox Private Browsing will remove path data from Referrers sent to third parties. This will help prevent accidentally leaking data to third parties. ---
**Author:** ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)\ **Post date:** [2018年二月3日 19:54 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474/7 "2018-02-03T19:54:00Z")
For a dynamic web app like Discourse, referer policy is probably more useful to be set at a page scope rather than for individual links. To dynamically set referer policy, use the `` element, and the _last set policy prevails_, which makes it very easy to code. An example policy: - " `no-referrer-when-downgrade` " by default - " `strict-origin-when-cross-origin` " when viewing private messages or secure categories With a site setting to change it to always be “strict-origin-when-cross-origin”, turned on by default for login required sites. If we decide Discourse doesn’t need its own referer information, strict-when-cro can be upgraded to “`strict-origin`” to save bandwidth. ---
**Author:** ![frictionel](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/frictionel/32/299701_2.png) [@frictionel](https://meta.discourse.org/u/frictionel)\ **Post date:** [2018年三月25日 15:30 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474/8 "2018-03-25T15:30:11Z")
I’m curious, why is `rel="noopener"` added in oneboxes but not normal external links? ![58](https://global.discourse-cdn.com/meta/original/3X/8/e/8e0a11df5cbe835d409ea756352054d68b16a45b.png) ![22](https://global.discourse-cdn.com/meta/original/3X/9/b/9b8c60fdd60fed58e3df878cfd7874c4134f23af.png) They also seem to be missing in the user-card. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2018年三月26日 01:15 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474/9 "2018-03-26T01:15:06Z")
Possibly an oversight cc @techapj ---
**Author:** ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)\ **Post date:** [2018年三月26日 06:16 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474/10 "2018-03-26T06:16:33Z")
> [@frictionel](#): > > why is rel=“noopener” added in oneboxes but not normal external links? `rel="noopener"` not being added in normal external links is actually correct behaviour because @codinghorror is TL4 and `tl3 links no follow` is disabled. `rel="nofollow noopener"` being added for @zogstrip (TL4) is a bug and onebox should respect the site setting `tl3 links no follow`. There is a bug report for this here: > [@Is there a way to remove nofollow from onebox](https://meta.discourse.org/t/is-there-a-way-to-remove-nofollow-from-onebox/78526): > > Continuing the discussion from ["exclude rel nofollow domains" not respected inside of onebox](https://meta.discourse.org/t/exclude-rel-nofollow-domains-not-respected-inside-of-onebox/71533): It seems that even after whitelisting a website, onebox nofollows every link, including internal. > [@frictionel](#): > > They also seem to be missing in the user-card. If the user is TL3 or above, `rel="nofollow noopener"` not being present is correct / as expected. ---
**Author:** ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)\ **Post date:** [2018年三月26日 13:39 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474/11 "2018-03-26T13:39:13Z")
> [@techAPJ](#): > > rel=“nofollow noopener” being added for @zogstrip (TL4) is a bug and onebox should respect the site setting tl3 links no follow. Fixed via: [https://github.com/discourse/discourse/commit/b75b6de982013fdfd08b8aecb1c701b35c787599](https://github.com/discourse/discourse/commit/b75b6de982013fdfd08b8aecb1c701b35c787599) ---
**Author:** ![frictionel](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/frictionel/32/299701_2.png) [@frictionel](https://meta.discourse.org/u/frictionel)\ **Post date:** [2018年三月26日 20:19 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474/12 "2018-03-26T20:19:55Z")
This seems to be a no-brainer: Why not trust a link that someone posted who is trusted by Discourse? But I was thinking about it a little more and this is the wrong question. How can you or @codinghorror or anyone be certain that the external site isn’t compromised? And if not now can’t it be malicious at some point in the future? So it’s not about trusting the user who posted the link but rather trusting the target site. Tell me that i’m wrong. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2018年三月26日 21:08 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474/13 "2018-03-26T21:08:20Z")
Then it sounds like you want a generic “warn that you are visiting an external website and there might be dragons” pop-up on clicking any link.. not really a fan of that, but [it is discussed here](https://meta.discourse.org/t/preventing-malicious-linking/37982). ---
**Author:** ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)\ **Post date:** [2024年六月8日 12:37 UTC](https://meta.discourse.org/t/optionally-add-noreferrer-to-external-links/79474/14 "2024-06-08T12:37:39Z")
该主题在 2319 天后自动关闭。不再允许回复。