[wp-trac] [WordPress Trac] #49558: Remove noreferrer from wp_targeted_link_rel and other uses

[WordPress Trac]

#49558: Remove noreferrer from wp_targeted_link_rel and other uses
-----------------------------------------------+---------------------------
 Reporter:  joostdevalk                        |       Owner:
                                               |  SergeyBiryukov
     Type:  enhancement                        |      Status:  accepted
 Priority:  normal                             |   Milestone:  5.6
Component:  General                            |     Version:
 Severity:  normal                             |  Resolution:
 Keywords:  needs-patch needs-unit-tests late  |     Focuses:
-----------------------------------------------+---------------------------
Changes (by SergeyBiryukov):

 * milestone:  5.5 => 5.6


Old description:

> When we added `noopener noreferrer` in #37941, the `noreferrer` bit was
> added specifically because at the time, Firefox didn't support
> `noopener`. Since it does now and has for a while, see
> [https://caniuse.com/#search=noopener here], I think we should remove it,
> as it does have nasty side effects: it breaks cross-site analytics.
>
> We should remove it everywhere, as links in the admin don't send a
> referrer anyway after [https://core.trac.wordpress.org/changeset/41741
> 41741] and as such there's no security risk to removing it.

New description:

 When we added `noopener noreferrer` in #37941, the `noreferrer` bit was
 added specifically because at the time, Firefox didn't support `noopener`.
 Since it does now and has for a while, see
 [https://caniuse.com/#search=noopener here], I think we should remove it,
 as it does have nasty side effects: it breaks cross-site analytics.

 We should remove it everywhere, as links in the admin don't send a
 referrer anyway after [41741] and as such there's no security risk to
 removing it.

--

Comment:

 It looks like Edge 18 still has 1.49% usage, so this cannot be addressed
 in time for 5.5, moving to 5.6.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/49558#comment:4>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform