Add referrer/opener parameters on search results links
The links in search results currently sends sensitive data to all PeerTube instances through the
Referrer header, such as the search query.
They might also allow the target page (a PeerTube instance) to tamper with the original page (search results page) through the
Solution : add
rel="origin noopener" to all search results links, including the links on thumbnails, to only show the FQDN in the
Referrer (not the full search query) and prevent the opened page to access the search results document context.
Disclaimer: I'm not a security expert, please review this advice.
~ Neil for 42l