Disable the User’s JavaScript Console
There are a few giant companies out there, namely Facebook and Netflix, who have decided to effectively disable a user's ability to execute JavaScript console commands. The decision was initially made by Facebook to prevent users from executing a specific set of commands which would expose user information via the JavaScript console (the message was sent to all Facebook users via a massive SPAM message). Of course this has been subject to loads of criticism, but before I weigh in, here's the code to do it:
// It appears Netflix is following (Facebook's lead)[https://news.ycombinator.com/item?id=7222129].
(function() {
try {
var $_console$$ = console;
Object.defineProperty(window, "console", {
get: function() {
if ($_console$$._commandLineAPI)
throw "Sorry, for security reasons, the script console is deactivated on netflix.com";
return $_console$$
},
set: function($val$$) {
$_console$$ = $val$$
}
})
} catch ($ignore$$) {
}
})();
Not that my opinion matters much, but I actually think this practice somewhat legit. From their perspective, if disabling the consoles helps to temporarily prevent an issue, you have to do it. In the long term, it's really not a good idea; they may become a target simply based on their effort to block people out. Regardless, this code seems to work so if you want to prevent console executions, this will do it.
I’m sure you can still get around this by injecting your own node but I can fully understand this practice.
why all the
$_$$in your variable names?javascript:window.console2 = (function () { var globals = [], iframe = document.createElement(‘iframe’), cleanWindow; iframe.src = ‘about:blank’; iframe.style.display = ‘none’; document.body.appendChild(iframe); return (iframe.contentWindow || iframe.contentDocument).console; }()); Object.defineProperty(window, “console”, { get: function () { return window.console2; } })s/var/window sorry :)
I had no idea that Object.defineProperty was even a thing. That’s awesome!
@gregg: Presumably to avoid namespacing issues, although that’s kind of stupid since this code is already in a closure.
Can’t a developer set a breakpoint and step over/ shortcut this?
Yes. This is why doing anything for security reasons in javascript is a waste of time, especially if it makes it harder to maintain the code.
Yeah, but this is just to prevent non-developers from pasting malicious JS into their own browser consoles.
But what if the code is uglified?
Why would you uglify it?
Why wouldn’t you uglify live code…?
You have made a good point here David, especially in the wake of people not taking this blocking too kindly. My reservation is this. If you’re blocking anything, do it tastefully. If you open up the console on FB and try to type something, you ll immediately see an ugly message that roughly translates to ‘Get lost’. They could ve easily done some mumbo jumbo that informs the person nicely about the block and made some JS Object variable available to experiment their site with. Khan Academy does something similar (they dont block the usage of console) but they do encourage you take a look at their KA object.
The physical address of the Facebook offices is 1 Hacker Way. So make some way for the hackers on your site!
why do you want to open up the console in facebook anyway?
let the cat and mouse chase begin !
If you open up the console in Facebook they provide a link. From there they let you enable it.
I can understand their perspective to some degree…great post David, very interesting!
firebug console still works on both.
I think Facebook (and Netflix) are not trying to prevent knowledgeable people to look into their website’s code. The point is to prevent people with no knowledge to harm themselves by following a hacker steps in a scam (Self XSS).
If you know how to circumvent the block (with a solution such as “Untitled” posted here), or if you know how to install Firebug, than you do have way more than enough knowledge to use all the power of the console in a manner that is safe for yourself. It’s not likely that any corporation would even bother to prevent you to do that.