Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[feat]: Enhanced handling of external links for StartOS #2419

Open
1 task done
k0gen opened this issue Sep 20, 2023 · 3 comments
Open
1 task done

[feat]: Enhanced handling of external links for StartOS #2419

k0gen opened this issue Sep 20, 2023 · 3 comments
Assignees
Labels
Enhancement New feature or request

Comments

@k0gen
Copy link
Member

k0gen commented Sep 20, 2023

Prerequisites

Describe the Feature Request

Currently, in StartOS, external links to outside webservers are opened seamlessly without any user interaction. This can potentially lead to information leakage and security risks. This feature request proposes enhancing the handling of external links to improve user awareness and control over their browsing experience within StartOS.

Describe the Use Case

This feature will enhance security awareness and control for StartOS users when accessing external content while still providing flexibility and convenience.

Describe Preferred Solution

Example Scenario:

  • User clicks on an external link.
  • A warning popup appears, stating, "You are about to exit StartOS's secure environment and access external content. Proceed with caution."
  • The user has the option to continue or cancel.
  • If the user chooses to trust the link, they can enable the "Trust {hostname} links from now on" toggle.
  • The selected hostname is added to the whitelist.
  • In subsequent visits to the trusted domain, the warning popup does not appear.

Describe Alternatives

No response

Anything else?

No response

@k0gen k0gen added the Enhancement New feature or request label Sep 20, 2023
@MattDHill
Copy link
Member

We include a noreferrer tag on hrefs. They are just visiting a website, no real privacy/security concern

@MattDHill MattDHill reopened this Sep 28, 2023
@MattDHill
Copy link
Member

Reopening so you can make a case for this, but I'm not seeing it. What's the worse that can happen in your opinion?

@k0gen
Copy link
Member Author

k0gen commented Oct 11, 2023

Great to know we use the noreferrer attribute! It is indeed a valuable security practice. In this context, it's crucial to address user awareness, making it clear that they are departing from a controlled environment to an unknown territory. This reassures users and ensures they understand the transition to external, potentially less secure locations.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants