If you are going to block further activity, to be safe block future requests in code too (a check on the event handler that might make the request most likely)

If you are going to block further activity, to be safe block future requests in code too (a check on the event handler that might make the request most likely) in case someone tries to automate the app via browser extension or bookmarklet. Just blocking clicks with a UI overlay doesn't always cut it. Or in case some fool on your dev team calls the events to automate (or for other reasons trigger) something that wasn't intended to be called that way, of course, though once you start defending against iffy practise from within you are fighting a battle you are going to lose!