For this question, we must first understand why it is intercepted. The browser will make "non-artificial" callswindow.open的弹窗进行拦截，什么叫做"非人为"的，就是浏览器判断在用户操作和window.open之间不是连续的，浏览器会认为可能是流氓程序弹出的广告窗口从而进行拦截
从楼主的描述可以看出，楼主应该是进行某个操作之后，通过ajax去获取一个url，然后通过window.open打开页面，我们都知道ajax是异步的，浏览器就认为不是连续的，所以就拦截了
解决方法可以先在操作（比如点击）的时候，直接window.open, and then go to ajax to obtain the data, and then assign a URL to the opened window. The approximate pseudo code is as follows:

el.addEventListener('click',function(){
    var winHandler = window.open("","_blank");
   ajax(function(url){
        winHandler.location.href = url;
   });
    
})

<a href="http://www.baidu.com" target="_blank" id="xx">hahah</a>
    <button type="button" id='btn'>clickme</button>
    <script>
        document.getElementById('btn').onclick = function() {
            document.getElementById('xx').click();
        }
    </script>

There’s nothing wrong with it.

Why add _blank?

window.open('www.baidu.com')

If the url has an http or https header

Write the event that triggers the method as an a tag, write the logic of obtaining the URL in the Controller pointed to by the a tag, and then return to a new page, bypassing the window.open method in short

For security reasons, the browser will automatically block pop-ups

Only a command that opens a new window within a short period of time after the user clicks it, such as window.open, will not be intercepted. This is a security restriction of the browser.

Try adding one more parameter to the ajax request:async: false