DEV Community

Discussion on: target="_blank" is a security risk?

Collapse
 
lexlohr profile image
Alex Lohr

There are multiple valid reasons to open a link in a new tab, the most compelling one of them being that you are inside a web app and the user expect links to open in a new tab.

And no, a wish for user retention is not a valid reason.

Collapse
 
deathshadow60 profile image
deathshadow60 • Edited

I could see that if the point is to open it in a browser when in a "native" app such as running under Electron. If it's web facing in the browser? Not so much.

The problem is far too many developers throw it at everything, just BEGGING to get their tuchas sued off for WCAG violations given the middle finger it is to users on screen readers, braille readers, etc, etc.

But then that's my bread and butter, helping website owners who are in court for accessibility failings under laws like the US ADA, UK EQA, etc, etc. Thus why 90% of my job is instructing client's development teams in ripping out every last dumbass HTML/CSS framework, shredding anything remotely resembling CSR unless it absolutely positively cannot be done without, and taking a sledgehammer to garbage like target="_blank", pixel metric fonts/layout, illegible colour contrasts, and endless idiotic "DIV soup".

Like the client (public utility) I just helped who had this issue, alongside a broken inaccessible train wreck of angular that made it impossible for around a quarter of clients to even pay their bills online. Said site now rewritten from using 2 megabytes of "JS for nothing" and broken HTML, to a site that doesn't even use JavaScript, has 1/8th the markup, and not an accessibility violation in sight. They were shoving new windows down the users gullet too, to the point that when (if) their idiotic CSR trash worked, just logging in to "pay your bill" opened four freaking tabs! ON THE SAME SITE!!!

That's some serious hurr durrz ermagahd aherpaderp right there.

Thread Thread
 
lexlohr profile image
Alex Lohr • Edited

Newsflash: you can run most electron apps that don't require node APIs directly in the browser. You can even install these web apps locally on most modern operating systems. And it's totally ok not to open a link in the same window in which a chat or a WebRTC meeting is currently open.

Yes, I get your point that target _blank is overused, but that doesn't make its use generally invalid inside the browser window. The main difference is the developer asking if target _blank actually improves the user experience and only uses it if the answer is "absolutely yes".