Add rel=noopener noreferrer to all target=_blank links in viewer for tab-nabbing safety

adad0b41c052d46cf62e61f6f61863848a4c3663 · 2026-06-03 09:00:14 -0700 · SteveStudio2

Files touched

M viewer/index.html

Diff

commit adad0b41c052d46cf62e61f6f61863848a4c3663
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Wed Jun 3 09:00:14 2026 -0700

    Add rel=noopener noreferrer to all target=_blank links in viewer for tab-nabbing safety
---
 viewer/index.html | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/viewer/index.html b/viewer/index.html
index 5990c1d..5116d68 100644
--- a/viewer/index.html
+++ b/viewer/index.html
@@ -75,7 +75,7 @@
   <h2>George — Gmail Accounts</h2>
   <div class="note">George's OAuth tokens are dead. <code>/auth</code> only re-authorizes
     <b>steve-office</b> (it hardcodes that login hint). Open in a tailnet browser:
-    <a href="http://100.107.67.67:9850/auth" target="_blank">http://100.107.67.67:9850/auth</a></div>
+    <a href="http://100.107.67.67:9850/auth" target="_blank" rel="noopener noreferrer">http://100.107.67.67:9850/auth</a></div>
   <table id="george">
     <thead><tr><th>Slot</th><th>Email</th><th>/auth re-auths it?</th><th>Reachable</th></tr></thead>
     <tbody></tbody>
@@ -114,8 +114,8 @@ function render(d){
     return '<tr><td>'+x.domain+'</td>'
       + '<td>'+pill('host',x.host)+'</td>'
       + '<td>'+zone+'</td><td>'+dns+'</td><td>'+ns+'</td><td>'+reg+'</td>'
-      + '<td>'+(x.pages_dev?'<a href="https://'+x.pages_dev+'" target="_blank">'+x.pages_dev+'</a>':'<span class="note">worker</span>')+'</td>'
-      + '<td><a href="'+x.live_url+'" target="_blank">open ↗</a></td></tr>';
+      + '<td>'+(x.pages_dev?'<a href="https://'+x.pages_dev+'" target="_blank" rel="noopener noreferrer">'+x.pages_dev+'</a>':'<span class="note">worker</span>')+'</td>'
+      + '<td><a href="'+x.live_url+'" target="_blank" rel="noopener noreferrer">open ↗</a></td></tr>';
   }).join('');
 
   const flipped = d.summary.flipped, total = d.summary.total;

← 16df055 Expand .gitignore to exclude dist/, build/, .next/, and *.ba · back to Coming Soon Template · migrate GoDaddy auth → Bearer PAT (TK-10 key rotation); sso- c507485 →