window.open with noopener opening URL in new window despite target=_self

Question

I'm trying to open a window using noopener property and target=_self. Essentially what I want is to open the URL in the same tab while preventing it to have access back to the originating URL. I'm trying with this syntax:

window.open('http://my-url.com', '_self', 'noopener');

However, this opens the new URL in a new window.

Is there some inherent functionality (maybe the browser back button?) which prevents a URL from opening in the same tab without having access to the previous window ? The docs say nothing about it (https://developer.mozilla.org/en-US/docs/Web/API/Window/open).

Thanks, Chris

Answer 1

window.open explicitly opens a new window.

You can use location.assign to navigate to a new page in the current window. (Or just use a normal link.)

I guess you’re worried about “tabnabbing”, right? That only applies to windows opened from your page (e.g. using _target=blank or window.open).

Setting noopener has no effect on a normal link that doesn’t open a new window.

Answer 2

I think location.replace() is what you want

window.location.replace("http://my-url.com");

replace() removes the current URL from the document history. With replace() it is not possible to use "back" to navigate back to the original document.