Design Guidance on Link Behaviors

[rajsite]

My team is working on a design system and one thing we are trying to drive consistency on in web applications is the behavior of links.

The Primer Design System link guidance for engineers seems direct. In-specific:

Don't force links to open in a new tab/window by setting the target property.

I'm trying to build a case for following the same guidelines in our design system. Specifically aligning with discussions from:

• WCAG 2.2 G200: Opening new windows and tabs from a link only when necessary
• WCAG 2.2 G201: Giving users advanced warning when opening a new window
• Nielson Norman Group 2020 article: Opening Links in New Browser Windows and Tabs

I'm curious how y'all address a couple situations:

1. While the guideline of "don't force links to open in a new tab / window" seems fairly well adopted, there do seem to be exceptions. How do you handle the exceptions / what guidelines make for appropriate exceptions?

   For example on the primer/design page most links do not open in a new tab but some do:

   • The top level link to the design system homepage:
     
   • The specific deployment link opens in a new tab but not the deployments page:
     
   • The links in the slide out menu open in a new tab:
     
     But not the mostly identical links at the bottom of the page:
     

2. For user editable content, i.e. "external links" / links to completely third party content, the links in that user content do not open in a new window and do not show redirect notice pages. They are just treated as any other link. That seems great but maybe even against OWASP recommendations like Preventing Unvalidated Redirects and Forwards:

   Force all redirects to first go through a page notifying users that they are going off of your site, with the destination clearly displayed, and have them click a link to confirm.

   For example like how links in Google Calendar invites (and many other google services) are pushed through their open redirector, i.e.: https://www.google.com/url?q=https://github.com/primer/design
   

   How did y'all decide to avoid having a redirector / warning for external links?

3. Maybe it's over extrapolating, but certain services like GitHub Projects and github.dev pages provide a more "app-like" experience and seem to have made the decision more frequently to force links to open in new tabs / windows.

   For example, an issue opened in the project view on GitHub opens in a slide out and clicking links in the description open in a new tab. However visiting that issue directly and clicking the same link will perform the design system guideline of not forcing links to open in a new tab.

   How do you draw the line of "app-like" experiences where it is okay for links to always be forced open in a new tab and "webpage-like" experiences that don't force links to open in a new tab?