By default, the DefaultLinkHandler
skips
click hijacking
in following situations.
1. if it's not clicking primary button (left button for right-handed).
2. if any of Alt/Ctrl/Meta/Shift
keys is pressed.
3. if the href on <a>
element starts with # (link to local hash)
, or it's a full url like https://... or ftp://....
4. if the <a>
has a target attribute and it is not targeting the current window.
<a href="/some/link" target="_blank">Skip Hijacking</a>
<a href="/some/link">Does Not Skip</a>
<a href="/some/link" target="_self">Does Not Skip</a>
<a href="/some/link" target="name-of-current-window">Does Not Skip</a>​
5. if the <a>
has special attribute download, or router-ignore
, or data-router-ignore
.
<a href="/some/link" download>Skip Hijacking</a>
<a href="/some/link" download="">Skip Hijacking</a>
<a href="/some/link" router-ignore>Skip Hijacking</a>
<a href="/some/link" router-ignore="">Skip Hijacking</a>
<a href="/some/link" data-router-ignore>Skip Hijacking</a>
<a href="/some/link" data-router-ignore="">Skip Hijacking</a>​