Ask HN: How to Restrict Webpage Access with JavaScript Enabled Browsers | Hacker News Reader

Ask HN: How to Restrict Webpage Access with JavaScript Enabled Browsers

1 pointelashri5 comments

How can we prevent access to a webpage server-side if the browser has JavaScript enabled? I'm not asking for any specific or realistic reason, but rather as an interesting thought experiment to explore potential server-side solutions. So what would you do if you want to achieve that?

View on HN

If it's a normal page accessed from the public you cannot. The reason is because the client is completely unknown and anonymous to the server. Therefore the server cannot trust or make assumptions upon the security or state of the client.

The best you could hope for is to impose some manner of authentication scheme so that the client and server are known and uniquely identified to each other at each page request irrespective of session. Then and only then are all options on the table.

This becomes not trivial, but easily accomplished, if the browser were requesting the page from a localhost server.

One method I have seen on hobby sites is to use JavaScript to replace the contents of the page with obnoxious flashy seizure inducing effects. Hats off to 4chan... Maybe don't do that but I think one could replace the contents of the page with a message saying that JS must be disabled to access.

I forgot to add, like others mentioned this does not protect the content rather it just blocks normal browsers from rendering it for the viewer. If that is your only goal then replacing what the viewer sees should suffice. If the goal is to protect content then the payload would need to be encrypted and the authorized viewers would need the key or password to decrypt the blob however part of this transaction is client side. Perhaps you could elaborate more around the use cases.

Any answer to this question is ultimately going to end in an answer that ties into WEI, which is anti-user as all get out.

Therefore, this request for pondering is summarily denied!

422

Can we count the ways...just look around the web. Start with msn and linkedin which now merrily spin in my browser but never show any content.

Reply on news.ycombinator.com