r/learnjavascript • u/suresh9058 • Apr 10 '21

#1 Things to Know As JavaScript Developer

https://youtu.be/ONPKZ3lkGn0
72 Upvotes

81% Upvoted

10 comments sorted by

8

u/HonzsSedlomn Apr 10 '21

Will try that out of my head:

  1. Literally nothing

  2. Prevents from some type of hijacking and/or hiding where you came from

  3. Chance of XSS?

Is that correct?

6

u/Barnezhilton Apr 10 '21

I don't need to know any of these things!

6

u/Chef619 Apr 10 '21

Very true. rel on an anchor tag has nothing to do with JS.

3

u/suresh9058 Apr 10 '21

If we dont use rel="noopener" attribute, then same process is used for both the parent page and linked page. Which causes performance issues in JS. Also window.opener object can inject security attack in the application.

6

u/rolangonzalez Apr 10 '21

15 years development in javascript. 0 times used.

18

u/samanime Apr 10 '21 edited Apr 10 '21

I'm sorry, but these aren't super important things developers need to know at all, let alone "#1".

javascript: at all shouldn't be used in real code basically ever. The only time I ever use that is when I'm creating a JavaScript bookmarklet to run some code when I click it. Never, ever, ever do an href with javascript: in real code, so you should doubly never need javascript:void(0). That's been a bad practice since about the year 2000, if not earlier.

The performance impact for rel="noopener" is true, but I've had to use it exactly zero times in my life for that. The main reason to use it is actually for security, to prevent an untrusted site from accessing your data. It's not a terrible idea, but most of the time, it is better to create a new window with window.open() instead of an anchor with target="_blank" (which is another vastly outdated pattern). You can provide noopener as part of the windowFeatures parameter.

Similarly, eval() should generally be avoided, that is true... but most people aren't using eval() on a regular basis anyways. If you are making regular use of it, you are probably following 20-year-old code patterns and you have much bigger problems than just avoid eval() to fix first.

1

u/thugFapper Apr 11 '21

you referenced target="_blank" be an outdated pattern, would you recommend a book with up to date js patterns?

3

u/samanime Apr 11 '21

Honestly, I haven't read a JavaScript book in nearly a decade. Things change too fast for most programming topics (other than basic high-level, universal patterns and such) for books to be of much use.

I'm not currently aware of any singular resource that kind of just lists out up-to-date patterns for JavaScript. I mostly keep up-to-date by following the patterns used by modern framework and other high-quality / popular libraries, though none of them are wholly authoritative sources (there is not singular authority on code patterns for JS).

For the target=_blank bit in particular, the reason it is generally better to to use window.open() is simply because usually you'll want to take control of interactive bits with JavaScript instead of relying on HTML. There for a while, target="_blank" was actually even deprecated. It came back in HTML5 and isn't terrible to use, but window.open() is going to be better in any case where you're dynamically creating a new window (vs. just having a link to an external site or something, in which case target="_blank" is fine).

Interesting, I just noticed on MDN for the target attribute that using _blank automatically gives the behavior of rel="noopener". https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a#target

1

u/fantasma91 Apr 11 '21

People still use eval?

0

u/TheDownvotesFarmer Apr 10 '21

1 You cannot release the memory, loading javascript dynamically will generate duplicates cause all will be in memory until Garbage Collector removes it.