javascript html jsp window.opener cross-origin-opener-policy

window.opener is NULL with right click on link

I'm using the javascript window.opener property to refresh the parent window in the child window.

The parent window cointains just a table with data and a link to the child window, when the child window is opened then executes a js function in the parent using the window.opener property, the js function in the parent refresh the table using ajax.

The problem is with window.opener because is NULL when the user open the link using the right click (contextmenu).

Example:

parent.jsp

<html>
    <head>
       <script type="text/javascript">
              function refreshTable() {
                 // ajax code to refresh the #theTable table, not important for this question
              }
       </script>
    </head>

    <body>
       <a href="/folder/child.jsp" target="_blank">OpenChild</a> 
       <table id="theTable">
           <tr>
            <td>...</td>
          </tr> 
       </table>
    </body> 
</html>

child.jsp

<html>
        <head>
           <script type="text/javascript">
                  $(document).ready( function() {
                     // opener is NULL when child is opened with right click
                     window.opener.refreshTable();

                  });
           </script>
        </head>
        <body>
            ...          
        </body> 
</html>

Solution

Ok I know it is late but I leave this here for future use

add

rel="opener"

to the target="_blank" link

<a href="/folder/child.jsp" target="_blank" rel="opener">OpenChild</a>

The opener will be passed through the child page

based on https://developer.mozilla.org/en-US/docs/Web/API/Window/opener

In the following cases, the browser does not populate window.opener, but leaves it null:

The opener can be omitted by specifying rel=noopener on a link, or passing noopener in the windowFeatures parameter.
From Firefox 79, windows opened because of links with a target of _blank don't get an opener, unless explicitly requested with rel=opener.
Having a Cross-Origin-Opener-Policy header with a value of same-origin prevents setting opener. Since the new window is loaded in a different browsing context, it won't have a reference to the opening window.

sidenote: btw there is no difference if you open a page with right or left click