{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/html/issues/2122","repository_url":"https://api.github.com/repos/whatwg/html","labels_url":"https://api.github.com/repos/whatwg/html/issues/2122/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/html/issues/2122/comments","events_url":"https://api.github.com/repos/whatwg/html/issues/2122/events","html_url":"https://github.com/whatwg/html/issues/2122","id":192625524,"number":2122,"title":"noopener header","user":{"login":"AliceWonderMiscreations","id":9934518,"avatar_url":"https://avatars.githubusercontent.com/u/9934518?v=3","gravatar_id":"","url":"https://api.github.com/users/AliceWonderMiscreations","html_url":"https://github.com/AliceWonderMiscreations","followers_url":"https://api.github.com/users/AliceWonderMiscreations/followers","following_url":"https://api.github.com/users/AliceWonderMiscreations/following{/other_user}","gists_url":"https://api.github.com/users/AliceWonderMiscreations/gists{/gist_id}","starred_url":"https://api.github.com/users/AliceWonderMiscreations/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AliceWonderMiscreations/subscriptions","organizations_url":"https://api.github.com/users/AliceWonderMiscreations/orgs","repos_url":"https://api.github.com/users/AliceWonderMiscreations/repos","events_url":"https://api.github.com/users/AliceWonderMiscreations/events{/privacy}","received_events_url":"https://api.github.com/users/AliceWonderMiscreations/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2016-11-30T17:15:17Z","updated_at":"2016-11-30T23:02:57Z","closed_at":"2016-11-30T17:19:36Z","body":"We need a standard header that will cause browser to apply `rel=\"noopener\"` to every link on a web page served with that header whether or not the rel attribute is specified with links.\r\n\r\nThis header could easily be used to update web applications that were coded before the `rel=\"noopener\"` attribute was proposed and for archived web pages. Something like\r\n\r\n    <IfModule mod_headers.c>\r\n    Header set window.opener \"none\"\r\n    </IfModule>\r\n\r\nDoesn't have to be that syntax precisely, but that's the concept. Websites that do not ever want to have their pages vulnerable to the broken `window.opener()` specification could then send that header with every http request and compliant browsers would not allow `window.opener()`\r\n\r\nAlternatively websites who want to only allow `window.opener()` from certain domains could include a list of white-listed domains. For example\r\n\r\n    <IfModule mod_headers.c>\r\n    Header set window.opener \"none +google.com +*.haxor.net\"\r\n    </IfModule>\r\n\r\nWhen the header is not sent, then the current behavior would remain. That should avoid any breakage of existing web applications.\r\n\r\nI propose that this header should NOT be allowed as a meta tag.\r\n\r\nI would appreciate it if someone who already understands the politics of how to get stuff pushed through write up actual RFC or whatever is needed. I'm not good at that sort of thing (or good with people in general)."},"comment":{"url":"https://api.github.com/repos/whatwg/html/issues/comments/264024796","html_url":"https://github.com/whatwg/html/issues/2122#issuecomment-264024796","issue_url":"https://api.github.com/repos/whatwg/html/issues/2122","id":264024796,"user":{"login":"foolip","id":498917,"avatar_url":"https://avatars.githubusercontent.com/u/498917?v=3","gravatar_id":"","url":"https://api.github.com/users/foolip","html_url":"https://github.com/foolip","followers_url":"https://api.github.com/users/foolip/followers","following_url":"https://api.github.com/users/foolip/following{/other_user}","gists_url":"https://api.github.com/users/foolip/gists{/gist_id}","starred_url":"https://api.github.com/users/foolip/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/foolip/subscriptions","organizations_url":"https://api.github.com/users/foolip/orgs","repos_url":"https://api.github.com/users/foolip/repos","events_url":"https://api.github.com/users/foolip/events{/privacy}","received_events_url":"https://api.github.com/users/foolip/received_events","type":"User","site_admin":false},"created_at":"2016-11-30T23:02:57Z","updated_at":"2016-11-30T23:02:57Z","body":"> There IS something actionable for the editors. A specification for a header a web server can send to tell browsers that `window.opener()` is not supported on the page.\r\n\r\n@clelland, have you considered something like this for Feature Policy?"}}
{"actor":{"display_login":"foolip"}}