add noreferrer to every target=_blank external link

58420cb43fdf3ada98112d806e460760983941f7 · 2026-05-19 15:14:05 -0700 · Steve Abrams

Four off-site links (DW footer, card sample CTA, product-page sample CTA,
product-page DW deep-link) had rel="noopener" but not noreferrer. Tabnabbing
protection without referrer leak prevention is half a fix; upgrade all four
to rel="noopener noreferrer" so the destination can't see the source URL on
the way in.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 58420cb43fdf3ada98112d806e460760983941f7
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 15:14:05 2026 -0700

    add noreferrer to every target=_blank external link
    
    Four off-site links (DW footer, card sample CTA, product-page sample CTA,
    product-page DW deep-link) had rel="noopener" but not noreferrer. Tabnabbing
    protection without referrer leak prevention is half a fix; upgrade all four
    to rel="noopener noreferrer" so the destination can't see the source URL on
    the way in.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/server.js b/server.js
index 82bb6da..ce39fb7 100644
--- a/server.js
+++ b/server.js
@@ -331,7 +331,7 @@ function footerHtml() {
   <div class="brand-block">Custom Digital Murals</div>
   <div class="links">
     <a href="mailto:info@customdigitalmurals.com">info@customdigitalmurals.com</a>
-    <a href="https://designerwallcoverings.com" target="_blank" rel="noopener">Order via DW</a>
+    <a href="https://designerwallcoverings.com" target="_blank" rel="noopener noreferrer">Order via DW</a>
   </div>
   <div class="tagline">Printed-to-order · Free memo samples · Trade service available</div>
 </footer>`;
@@ -432,7 +432,7 @@ function load(){
           '<div class="card-vendor">'+esc(p.vendor)+'</div>'+
           '<div class="card-title">'+esc(p.title)+'</div>'+
           (price?'<div class="card-price">'+price+'</div>':'')+
-          '<a class="card-sample" href="'+esc('https://designerwallcoverings.com/products/'+p.handle+'#sample')+'" onclick="event.stopPropagation()" target="_blank" rel="noopener">Order Free Sample</a>'+
+          '<a class="card-sample" href="'+esc('https://designerwallcoverings.com/products/'+p.handle+'#sample')+'" onclick="event.stopPropagation()" target="_blank" rel="noopener noreferrer">Order Free Sample</a>'+
         '</div>'+
       '</div>';
     }).join('');
@@ -518,8 +518,8 @@ ${headerHtml('')}
     <h1>${escHtml(p.title)}</h1>
     <div class="price">${escHtml(price)}</div>
     ${prose ? `<div class="body-prose">${escHtml(prose)}</div>` : ''}
-    <a class="sample-cta" href="${escHtml(sampleUrl)}" target="_blank" rel="noopener">Order Memo Sample (free)</a>
-    <a class="dw-link" href="${escHtml(dwUrl)}" target="_blank" rel="noopener">View on Designer Wallcoverings &rarr;</a>
+    <a class="sample-cta" href="${escHtml(sampleUrl)}" target="_blank" rel="noopener noreferrer">Order Memo Sample (free)</a>
+    <a class="dw-link" href="${escHtml(dwUrl)}" target="_blank" rel="noopener noreferrer">View on Designer Wallcoverings &rarr;</a>
     ${tags.length ? `<div class="tags">${tags.map(t => `<span class="tag">${escHtml(t)}</span>`).join('')}</div>` : ''}
     ${imgs.length > 1 ? `<div style="display:grid;grid-template-columns:repeat(3,1fr);gap:4px;margin-top:28px;">${imgs.slice(1,4).map(img => `<img src="${escHtml(img)}" alt="${escHtml(p.title)}" loading="lazy" style="width:100%;aspect-ratio:1;object-fit:cover;">`).join('')}</div>` : ''}
   </div>

← 48db475 sort + density persist to localStorage; hydrate before first · back to Customdigitalmurals · guard against serving .bak/.pre- snapshot files; widen .giti 58bcf6a →