Summary

  • A target="_blank" link once commonly created a new page with an opener relationship, giving the destination a handle back to the original tab.
  • A 2018 proposal and a 2019 HTML change made noopener the default for these links, while rel="opener" became an explicit request for the old connection.

Click a link, see a new tab, keep reading. The old page sits behind you like a room with its door closed. In the browser’s older arrangement, the new page could still hold a handle to that room through window.opener. The link had opened two views and left an invisible cord between them. A destination with that handle could navigate the original tab. The visual metaphor of separate tabs concealed a relationship of control.

The WHATWG HTML issue opened on 10 October 2018 put the awkward default on the table. Chris Dumez observed that a link with target="_blank" then provided an opener unless the author added rel="noopener". He proposed flipping the default: disconnect the new page and let authors ask for rel="opener" when a connection was intended. The issue identified a familiar web problem. A feature that had been convenient for cooperating pages also gave an unrelated destination a route back to the page that sent the visitor there.

The next day, a WebKit bug report recorded an experiment: treat target="_blank" on anchors as though rel="noopener" were present, with rel="opener" available for the deliberate connection. It was a small change in markup behavior and a large change in the assumption behind a click. The site linking away no longer had to remember a protective keyword at every exit. The browser could start from a disconnected pair of rooms.

The WHATWG change merged on 7 February 2019 made that new default part of HTML. Its title stated the trade plainly: make _blank imply noopener and support opener. In the current hyperlink algorithm, noopener or noreferrer explicitly disconnects the opener; _blank also disconnects it when opener is absent. The special opener keyword is the author’s affirmative request to keep the relationship. The visible result is still a new tab. The invisible privilege has changed owners.

This is a neat example of standards work moving a default from the publisher’s checklist into the browser’s behavior. Under the older rule, forgetting one rel token could give the destination a handle to the originating tab. Under the newer rule, the author must make the connection legible in markup. A page that needs two windows to coordinate can request it. A routine article link can simply open another page and let the old one remain where the reader left it.

There is also a subtle lesson in the word “new.” A new tab is a piece of interface, not a complete description of the authority behind it. The user sees two rectangles; the browser decides whether one may address the other. The 2018 issue, the WebKit experiment and the 2019 standard edit took one such hidden edge and made separation ordinary. The cord did not need a dramatic cutting ceremony. The browser merely stopped tying it by default.