preventing external page from redirecting MY (parent) page

Question

Using the latest version of Chrome on Mac OS 10.7.

I assume it is some clever javascript that is enabling the folks at this webpage:

http://www.chairworks.com/

...to close my (the parent) page which opened their (chairworks.com) page in the first place. I did not open them with javascript, but with an <a> tag with the target="_blank" attribute.

If I disable javascript, then the behavior stops.

<a href="http://www.chairworks.com" target="_blank">www.chairworks.com</a>

I would expect the page at chairworks.com/ to simply open in another tab/window... but what I find is that as soon as the new browser tab opens, it closes, and then my page (the parent tab/window) gets redirected to the chairworks.com page.

Kinda rude.

Can someone point me to what code enables them to do that? And how do I prevent it? (Assuming I want a link to behave as expected, such as in my demo page.)

Answer 1

I believe the proper thing to do is set corresponding link type attribute so the browser doesn't provide the target window with and opener reference.

<a href="https://untrusted-site.org" target="_blank" rel="noreferrer noopener">Link</a>

You can read more about link types here: https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types

Answer 2

This is the script they are using:

setTimeout('redirect_page()',0);
function redirect_page(){if (window.opener) { window.opener.location.href = '/home.html'; window.close(); } else { location.href = '/home.html'; }}

As to how to circumvent it (just an idea):
Create your own blank page, with it's source set to about:blank. When it loads (or after a time-out) you could write some code to that window that will then open the offending link. Then the offending link just closes your buffer-page. F*ck 'm!! Power to the user!

Edit: looks like you could also name your page home.html hehe, but that is not such a workable solution..

Final Edit: SIMPLE LOGIC people...
<a href="http://www.chairworks.com/home.html" target="_blank">www.chairworks.com</a>
works for everyone, no javascript needed.
See this working jsfiddle example.