[object Object]

← back to Lifestyle Asset Intel

add noreferrer to topnav external-target links

bf3e286e3cae86b2442a029b39126e8dee4a4a41 · 2026-05-19 21:09:58 -0700 · Steve Abrams

The Sources / OpenAPI / API links open in a new tab and had rel="noopener"
but no noreferrer, leaking the originating page URL via Referer. Hardens
them to rel="noopener noreferrer" — matches the cite-link convention in
views/asset.ejs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

Diff

commit bf3e286e3cae86b2442a029b39126e8dee4a4a41
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 21:09:58 2026 -0700

    add noreferrer to topnav external-target links
    
    The Sources / OpenAPI / API links open in a new tab and had rel="noopener"
    but no noreferrer, leaking the originating page URL via Referer. Hardens
    them to rel="noopener noreferrer" — matches the cite-link convention in
    views/asset.ejs.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 views/partials/head.ejs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/views/partials/head.ejs b/views/partials/head.ejs
index 5efc637..884a598 100644
--- a/views/partials/head.ejs
+++ b/views/partials/head.ejs
@@ -26,9 +26,9 @@
     <a href="/indices/birkin-30-togo-neutral" class="<%= path && path.indexOf('/indices') === 0 ? 'active' : '' %>">Indices</a>
     <a href="/portfolio" class="<%= path && path.indexOf('/portfolio') === 0 ? 'active' : '' %>">Portfolio</a>
     <a href="/methodology" class="<%= path === '/methodology' ? 'active' : '' %>">Methodology</a>
-    <a href="/api/sources" target="_blank" rel="noopener">Sources</a>
-    <a href="/api/openapi.json" target="_blank" rel="noopener">OpenAPI</a>
-    <a href="/api/health" target="_blank" rel="noopener">API</a>
+    <a href="/api/sources" target="_blank" rel="noopener noreferrer">Sources</a>
+    <a href="/api/openapi.json" target="_blank" rel="noopener noreferrer">OpenAPI</a>
+    <a href="/api/health" target="_blank" rel="noopener noreferrer">API</a>
   </nav>
   <button class="theme-toggle" id="themeToggle" aria-label="Toggle dark mode" title="Toggle dark mode">
     <svg class="icon-sun" viewBox="0 0 24 24" width="18" height="18" aria-hidden="true">

← f402188 gitignore snapshot files + 404-guard .bak/.pre-/.orig paths  ·  back to Lifestyle Asset Intel  ·  add density slider to /family grid ae0a5ef →