3 ms·

Ask HN: How to Restrict Webpage Access with JavaScript Enabled Browsers

1 points by elashri 3y ago

How can we prevent access to a webpage server-side if the browser has JavaScript enabled? I'm not asking for any specific or realistic reason, but rather as an interesting thought experiment to explore potential server-side solutions. So what would you do if you want to achieve that?

LinuxBender 3y ago
One method I have seen on hobby sites is to use JavaScript to replace the contents of the page with obnoxious flashy seizure inducing effects. Hats off to 4chan... Maybe don't do that but I think one could replace the contents of the page with a message saying that JS must be disabled to access.
- LinuxBender 3y ago
  I forgot to add, like others mentioned this does not protect the content rather it just blocks normal browsers from rendering it for the viewer. If that is your only goal then replacing what the viewer sees should suffice. If the goal is to protect content then the payload would need to be encrypted and the authorized viewers would need the key or password to decrypt the blob however part of this transaction is client side. Perhaps you could elaborate more around the use cases.
austin-cheney 3y ago
If it's a normal page accessed from the public you cannot. The reason is because the client is completely unknown and anonymous to the server. Therefore the server cannot trust or make assumptions upon the security or state of the client. The best you could hope for is to impose some manner of authentication scheme so that the client and server are known and uniquely identified to each other at each page request irrespective of session. Then and only then are all options on the table. This becomes not trivial, but easily accomplished, if the browser were requesting the page from a localhost server.
salawat 3y ago
Any answer to this question is ultimately going to end in an answer that ties into WEI, which is anti-user as all get out. Therefore, this request for pondering is summarily denied! 422
flaptrap 3y ago
Can we count the ways...just look around the web. Start with msn and linkedin which now merrily spin in my browser but never show any content.

1 points by elashri 3y ago

LinuxBender 3y ago

One method I have seen on hobby sites is to use JavaScript to replace the contents of the page with obnoxious flashy seizure inducing effects. Hats off to 4chan... Maybe don't do that but I think one could replace the contents of the page with a message saying that JS must be disabled to access.

LinuxBender 3y ago
I forgot to add, like others mentioned this does not protect the content rather it just blocks normal browsers from rendering it for the viewer. If that is your only goal then replacing what the viewer sees should suffice. If the goal is to protect content then the payload would need to be encrypted and the authorized viewers would need the key or password to decrypt the blob however part of this transaction is client side. Perhaps you could elaborate more around the use cases.

austin-cheney 3y ago

If it's a normal page accessed from the public you cannot. The reason is because the client is completely unknown and anonymous to the server. Therefore the server cannot trust or make assumptions upon the security or state of the client. The best you could hope for is to impose some manner of authentication scheme so that the client and server are known and uniquely identified to each other at each page request irrespective of session. Then and only then are all options on the table. This becomes not trivial, but easily accomplished, if the browser were requesting the page from a localhost server.

salawat 3y ago

Any answer to this question is ultimately going to end in an answer that ties into WEI, which is anti-user as all get out. Therefore, this request for pondering is summarily denied! 422

flaptrap 3y ago

Can we count the ways...just look around the web. Start with msn and linkedin which now merrily spin in my browser but never show any content.