3 ms·
Quick question, is there any difference between running code in the browser bar vs. running it in the Chrome console? If there isn't, Chrome should just disable
by bialecki 15y ago
Quick question, is there any difference between running code in the browser bar vs. running it in the Chrome console? If there isn't, Chrome should just disable this behavior. I don't think I've ever run code in the browser bar vs. the console because I usually have the console open or it's very easy to get to.
I bet most users would smell something fishy if they had to use something like the console to see a video. "Going to a website," even if it's a JS snippet, not a website, is something people are used to. Looking at developer tools, even if it's asking an end user to just see if there was an error, still feels very strange to them.
- mkjones 15y agoI'm not 100% sure, but I think the chrome console is essentially the same, but you needn't prepend with javascript: and it has like autocompletion and history and a bunch of other things. Not sure why anyone would legitimately use the address bar for js.
- jrockway 15y agoNot sure why anyone would legitimately use the address bar for js. Bookmarklets, like http://kathack.com/ http://kathack.com/.
- re 15y agoBrowsers can support bookmarklets without allowing javascript to be entered directly in the address bar.
- scotth 15y agoThen the attack shifts. The "security check" becomes, drag this link to your bookmark bar and click it.
- simonbrown 15y agoA solution to that for browser vendors: Don't let the user drag javascript links from iframes into the bookmark bar.
- jrockway 15y agoWhy let users do anything in their browser? What if someone tricks them into jumping out their window?
- newhouseb 15y agoMobile web browsers sadly don't have console access like this so the address bar is the only way to go (ignoring scripts like weinre).