Hi all!
I've finally decided to investigate why links from my blog (published
via sr.ht pages) to external pages only ever open if I explicitly
instruct the browser to open the link in a new tab. By just clicking the
link, nothing happens.
To me, the html code of my website [1] looks fine, e.g.:
<a rel="noopener noreferrer"
href="http://creativecommons.org/licenses/by/4.0/" target="_blank"
class="ext-links">CC BY 4.0</a>
I'd expect this link to open in a new tab when clicking on it in a
browser. This is also the behavior which I observe when I serve & browse
my blog locally.
Could sourcehut pages' CSP [2] possibly interfere at this point? What
are other possible causes of this issue?
Thanks in advance for your help.
Best,
Alex
[1]: https://www.puer-robustus.eu
[2]: https://srht.site/limitations
As Ignas pointed out to me (thanks!), it is indeed the CSP:
> target="_blank" requires an allow-popups directive when CSP has a
sandbox directive
I found an old email thread [1], where Drew defends the exclusion of
"allow-popups" from the sandbox CSP. Personally, I'd be interested in
him elaborating more on that decision.
If Drew stands by his CSP decision, is this worth being documented as a
limitation of the CSP? Clicking on a link with nothing happening is a
bit irritating ...
For the time being I'll remove the target="_blank" from the links in my
blog.
[1]:
https://lists.sr.ht/~sircmpwn/sr.ht-discuss/%3Cfc729915-55f3-eff5-e345-c1fb0560a41b%40coolguy.website%3E
On 4/29/22 22:24, Alex wrote:
> As Ignas pointed out to me (thanks!), it is indeed the CSP:> >> target="_blank" requires an allow-popups directive when CSP has a> sandbox directive> > I found an old email thread [1], where Drew defends the exclusion of> "allow-popups" from the sandbox CSP. Personally, I'd be interested in> him elaborating more on that decision.
Can't speak for Drew, but I personally very much support that sites (not
just srht) should not be able to open popups, ever :)
I would concede that one can have different opinions on the fact that
the spec considers target=_blank the same as opening a popup, but to me,
even that does make sense. But even if you don't, allowing popups
outright seems like a pretty bad trade-off.
> If Drew stands by his CSP decision, is this worth being documented as a> limitation of the CSP? Clicking on a link with nothing happening is a> bit irritating ...
One person's limitation is another one's feature :) I find it irritating
when I click a link and a new tab opens. Why not trust your readers that
they can decide for themselves how to open a link?
> For the time being I'll remove the target="_blank" from the links in my> blog.
I wholeheartedly support that :)
Conrad
On 01.05.22 17:18, Conrad Hoffmann wrote:
>> I found an old email thread [1], where Drew defends the exclusion of>> "allow-popups" from the sandbox CSP. Personally, I'd be interested in>> him elaborating more on that decision.> > Can't speak for Drew, but I personally very much support that sites (not> just srht) should not be able to open popups, ever :)> > I would concede that one can have different opinions on the fact that> the spec considers target=_blank the same as opening a popup, but to me,> even that does make sense. But even if you don't, allowing popups> outright seems like a pretty bad trade-off.
I fully agree that sites should never be allowed to open popups. That
opening new tabs would fall into the same category wasn't immediately
obvious to me but it actually makes sense: just imagine all the popups
found on sites of the early internet age opening in tabs ...
So I rest my case with regard to the exclusion of the "allow-popups"
directive.
>> If Drew stands by his CSP decision, is this worth being documented as a>> limitation of the CSP? Clicking on a link with nothing happening is a>> bit irritating ...> > One person's limitation is another one's feature :) I find it irritating> when I click a link and a new tab opens. Why not trust your readers that> they can decide for themselves how to open a link?
Personally, I have changed my mind yesterday already: I do not want to
force another tab on my readers when clicking a link. If they want to,
they have the means to do so in their browser.
But personal taste notwithstanding, I'd argue that a note about this
particular "limitation" of the CSP in the sr.ht pages docs would make
sense given that I am not the first one to stumble upon this. Will
gladly provide a patch if Drew deems this necessary.
> But personal taste notwithstanding, I'd argue that a note about this> particular "limitation" of the CSP in the sr.ht pages docs would make> sense given that I am not the first one to stumble upon this. Will> gladly provide a patch if Drew deems this necessary.
I agree 100% with that.
While I understand Drew's point and where he comes from, opening external links
in tabs in now an expected behavior for most websites. Personally I am not
willing to compromise on that feature. It's perfectly ok, it just means that
SourceHut sites are not for me. No need to get philosophical here.
That being said, I just lost 2 hours migrating my website from Gitlab to
SourceHut and then trying to understand why my hugo-built website was not
behaving as before when it was hosted on Gitlab. I read the "limitations" page
on srht.site prior doing all that. IMO, without being an experienced web
developer, it is hard to understand the full range of limitations introduced by
the CSP header. Ideally all elements of the CSP should be explained so laymen
would understand as well. At the very least, a simple one-line warning to
explicitly detail that links can not open in tabs would be more than welcome!
- Thomas
On 8/2/22 12:23, Thomas Lambert wrote:
> At the very least, a simple one-line warning to> explicitly detail that links can not open in tabs would be more than welcome!
Not an unreasonable request. I sent a patch [1], let's see what Drew
says. I would however also caution that you totally should at least skim
over the CSP documentation and check how it might relate to your page.
Spelling out the policy itself is the most concise way of conveying the
necessary information.
[1] https://lists.sr.ht/~sircmpwn/sr.ht-dev/patches/34384
Conrad