Lighthouse: `target="_blank"` links should now imply `rel="noopener"`

[Malvoz]

This is about the external-anchors-use-rel-noopener.js audit.

In a recent WHATWG spec change, all target="_blank" links should now imply rel="noopener".
And the opener link relation was added.

Perhaps once browsers have implemented these changes, the audit could warn about occurrences of rel="opener" links instead?

The new Cross-Origin-Opener-Policy HTTP header is related.

Additionally, the rel attribute is now supported on <form> elements as well.

---

Changes to the audit would affect the documentation at https://web.dev/external-anchors-use-rel-noopener, should I open an issue @web.dev too?

[patrickhulce]

Great point thanks for filing @Malvoz! We should definitely update the documentation either way to address this development. As for the audit, I guess it depends on what level of ubiquity this needs to reach for us to stop giving out this advice.

IMO, we wouldn't ever flag explicit opener values since if you're explicitly opting in the assumption is that you needed to for some reason.

[paulirish]

@Malvoz do you have tracking bugs for the browsers making this change?

[Malvoz]

• https://bugs.chromium.org/p/chromium/issues/detail?id=898942
• https://bugzilla.mozilla.org/show_bug.cgi?id=1522083
• https://bugs.webkit.org/show_bug.cgi?id=190481

[connorjclark]

chromium bug is still open.

and we need time for these older modern browsers to become even older.

[coliff]

Update: Safari and Firefox now already rel="noopener" on target="_blank" links - and Chrome/Edge are due to roll this out in release 88 which is scheduled to hit stable in January 2020.

Hopefully Lighthouse won't warn about having target="_blank" links without rel="noopener" a short while after this release has shipped.
REF: https://www.chromestatus.com/feature/6140064063029248

[patrickhulce]

Thanks @coliff! My guess is we'll target this for Lighthouse 8 in the spring, to give ample time for most users to catch up, but we can discuss in the next meeting.

Action item here would be deleting this audit.