window.opener reference lost in Firefox-CodePudding

Consider the following case:

Step 1: Website A opens Website B in a new tab (At this point Website B has its opener window reference i.e Website A window object in window.opener).
Step 2: Website B redirects to Website C (We have window.opener referencing Website A window here too).
Step 3: Then Website C performs some authentication and redirects back to Website B. At this step 3 the window.opener has the reference of the current window object i.e window object of Website B itself (window.opener === window) and we’ve lost reference to the original opener (i.e Website A window object). We need the window.opener object for communicating with Website A using postMessage.

Note: We don’t have control over Website C and can’t control how they’re redirecting back to Website B. Also this is happening only on Firefox/Safari. On Chrome we're able to get the original opener reference after redirections.

In case Website C is redirecting with rel=noopener the window.opener should be null (Reference from MDN). I’m not able to understand in which case the window.opener can be the current window object and why it is happening on Firefox/Safari but not on Chrome? And is there anything we can do anywhere except Website C to prevent this?

CodePudding user response：

This is possible in firefox and Safari, window.opener can be current window when you add target _self. If you do window.open('someurl', '_self') then window.opener will be current window and will open in same tab instead of a new tab. This only happens in safari and firefox(from what i have observed). All chromium based browsers don't change the original window opener in any case.

I don't know the exact reason why safari and firefox handles it this way I tried to find the reason but can't find it.

I faced this issue once and the solution which we did was to ask website C to use either window.location.replace or window.location.href to redirect back to website B so they open website b in same tab.