Comparison
Clickjackingvsnoopener
Clickjacking
your page was loaded in an invisible iframe over someone else's button, and the click landed on yours.
Framing a target site transparently over attacker-controlled content so the user's clicks are delivered to it unknowingly. The defence is refusing to be framed, with `frame-ancestors` in a Content Security Policy or the older `X-Frame-Options`. Any authenticated page that performs an action on click needs it, which in practice means the whole application.
Full entry →noopener
you opened a link in a new tab and the other site could reach back and navigate the tab you came from.
A link relation preventing the opened page from receiving a `window.opener` reference to yours. Without it, the destination can redirect your original tab to a phishing page while the user is looking elsewhere. Browsers now imply it for `target="_blank"`, but any window opened by script still needs it explicitly.
Full entry →