Any way to block access to my site if users are blocking javascript? - GoFuckYourself.com

HighlyIntoxicated · 03-29-2011, 04:29 PM

One of the functions on my site relies on javascript, and people have been getting around it, by disabling js.

Is there any way to block users from my site/redirect them to a page, if they have javascript disabled?

seeandsee · 03-29-2011, 04:30 PM

yes there is, i dont know how, but i saw content lockers have protection against it so there is some working solution

HighlyIntoxicated · 03-29-2011, 04:34 PM

I've seen something similar with a content locker, except it blocked users access to the site if they had adblock enabled.

Both of these features would be awesome if anyone knows where I could find em.

rowan · 03-29-2011, 04:35 PM

Can you explain the particular functionality on your site in more detail? Does it involve fetching something from the server? If so, you could do that through j/s.

Another option would be to redirect to the content/function via j/s, and use <noscript>sorry, you need j/s enabled</noscript> kinda thing.

Both could be worked around by someone viewing the source, unless your j/s does some tricky obfuscated calculations to come up with a valid key that your server is expecting...

HighlyIntoxicated · 03-29-2011, 04:39 PM

My site isnt doing anything too complicated. I am using a content locker which relies on javascript, if users disable js they are able to get to the content, which is what im trying to fix.

prezzz · 03-29-2011, 05:07 PM

I found this solution on StackOverflow a while ago while I was searching for something completely unrelated.

Whenever a user has Javascript disabled, the <noscript> tags come into play. Among other things, you can put some CSS code within those tags and it'll be fully processed. In this case, you could wrap your entire site into a specific <div> like this:

<div id="sitewrapper">
...your site content...
</div>

and then activate a special CSS definition for those that have Javascript disabled:

<noscript>
<style type="text/css">#sitewrapper {display: none;}</style>
</noscript>

TripleXPrint · 03-29-2011, 05:15 PM

Quote:

Originally Posted by prezzz

I found this solution on StackOverflow a while ago while I was searching for something completely unrelated.

Whenever a user has Javascript disabled, the <noscript> tags come into play. Among other things, you can put some CSS code within those tags and it'll be fully processed. In this case, you could wrap your entire site into a specific <div> like this:

<div id="sitewrapper">
...your site content...
</div>

and then activate a special CSS definition for those that have Javascript disabled:

<noscript>
<style type="text/css">#sitewrapper {display: none;}</style>
</noscript>

This will work only if you're using it to "hide" the content, not block access.

Varius · 03-29-2011, 05:26 PM

You should not be relying on client-side code to protect your content/control access

If you really want to, you can look into javascript and/or html obfuscation, but know all of them are breakable fairly easily and may cause some browser trouble.

If you just want a solution that works against the "average" surfer, make an Ajax call via jQuery which then outputs the HTML needed to show the content; in other words, don't have it embedded in your HTML source.

Tempest · 03-29-2011, 05:31 PM

Difficult to do... Could have some PHP on every page that checks a block IP list... Using the noscript tags, you could call an iframe that adds the IP to the list or maybe set something in a session.. The PHP would have to clear out old IPs/session every so often as well. The check might have to be in an iframe after the noscript one so that the IP/session gets recorded first. Just off the top of my head, something like that.

But yeah, the content protection should default to NO ACCESS unless they have javascript enabled.

DangerX !!! · 03-29-2011, 05:51 PM

You can only block users with very little computer knowledge in this way, every more advanced user will pass this blockade in a matter of minutes.

HighlyIntoxicated · 03-29-2011, 05:57 PM

Thanks for the information.

At the moment the content locker is doing a fairly good job, with only a few people getting around it, perhaps i'll just ride it out.

camperjohn64 · 03-29-2011, 07:27 PM

You can ONLY deliver this page:

<html>
<script>
document.location = "realpage.html";
</script>
You must enable javascript to see this
</html>

If the person doesn't have javascript active, it never gets to realpage.html

camperjohn64 · 03-29-2011, 07:30 PM

If you wanted to get fancy, you could obfuscate the javascript target to go to index.php?page=fbdbe7277d7a77&md5=abb5b2bfbdbe7277 d7a77f7e.php and that page could then do an MD5 checksum on the md5 to confirm it's a valid target page.

This would make the hardest of hackers give up and just turn on javascript.

InfoGuy · 03-30-2011, 05:34 AM

Access to your content may not be the primary motive of everyone that blocks scripts. Have you considered the possibility that some surfers block scripts by default to protect themselves from malware?

HighlyIntoxicated · 03-30-2011, 06:06 AM

Quote:

Originally Posted by InfoGuy

Access to your content may not be the primary motive of everyone that blocks scripts. Have you considered the possibility that some surfers block scripts by default to protect themselves from malware?

I am aware there are legitimate reasons to block scripts, however I know for certain people are turning off js to get around my content locker, as i have seen it discussed on forums.

u-Bob · 03-30-2011, 06:14 AM

1. Client side 'protection' can always be circumvented.
2.
using Javascript print an <img src="/somephp.php">

have somephp.php set a cookie.

have your other pages check if the user came from your site (referrer) and if they have the cookie that is set by somephp.php. If they don't have the cookie, they are probably blocking js.

SmokeyTheBear · 03-30-2011, 07:45 AM

i dont get why you dont use css to hide the content.. explain what you are trying to protect ?

redwhiteandblue · 03-30-2011, 08:07 AM

Quote:

Originally Posted by camperjohn64

You can ONLY deliver this page:

<html>
<script>
document.location = "realpage.html";
</script>
You must enable javascript to see this
</html>

If the person doesn't have javascript active, it never gets to realpage.html

That'll work right up until they view the source and type "realpage.html" into their browser.

cam_girls · 03-30-2011, 08:21 AM

Really basic method if you have a page where they come from, use onclick on the button.

Quote:

fris · 03-30-2011, 08:24 AM

Quote:

Originally Posted by cam_girls

Really basic method if you have a page where they come from, use onclick on the button.

bad advice homie

iamtam · 03-30-2011, 08:25 AM

on their first page, use javascript to write a cookie. as they hit enter, read the cookie with php on the inside page. if there is no cookie set, redirect them back to the front page. if they have java turned off, there will never be a cookie, so java is likely disabled.

03-29-2011, 04:29 PM	#1
HighlyIntoxicated Confirmed User Join Date: Dec 2009 Posts: 542	Any way to block access to my site if users are blocking javascript? One of the functions on my site relies on javascript, and people have been getting around it, by disabling js. Is there any way to block users from my site/redirect them to a page, if they have javascript disabled?

03-29-2011, 04:30 PM	#2
seeandsee Check SIG! Industry Role: Join Date: Mar 2006 Location: Europe (Skype: gojkoas) Posts: 50,945	yes there is, i dont know how, but i saw content lockers have protection against it so there is some working solution __________________ BUY MY SIG - 50$/Year Contact here

03-29-2011, 05:07 PM	#6
prezzz Confirmed User Industry Role: Join Date: Jul 2004 Posts: 959	I found this solution on StackOverflow a while ago while I was searching for something completely unrelated. Whenever a user has Javascript disabled, the <noscript> tags come into play. Among other things, you can put some CSS code within those tags and it'll be fully processed. In this case, you could wrap your entire site into a specific <div> like this: <div id="sitewrapper"> ...your site content... </div> and then activate a special CSS definition for those that have Javascript disabled: <noscript> <style type="text/css">#sitewrapper {display: none;}</style> </noscript> __________________ TEMPLATEHYPE.COM - PREMIUM MECHBUNNY TEMPLATES Responsive Mechbunny templates now available - NEAT TUBE - REDDY TUBE

03-29-2011, 05:26 PM	#8
Varius Confirmed User Industry Role: Join Date: Jun 2004 Location: New York, NY Posts: 6,890	You should not be relying on client-side code to protect your content/control access If you really want to, you can look into javascript and/or html obfuscation, but know all of them are breakable fairly easily and may cause some browser trouble. If you just want a solution that works against the "average" surfer, make an Ajax call via jQuery which then outputs the HTML needed to show the content; in other words, don't have it embedded in your HTML source. __________________ Skype variuscr - Email varius AT gmail

03-29-2011, 05:51 PM	#10
DangerX !!! Confirmed User Industry Role: Join Date: Feb 2011 Location: La Isla Bonita Power Level: ❤❤❤❤❤❤❤❤❤❤ Posts: 886	You can only block users with very little computer knowledge in this way, every more advanced user will pass this blockade in a matter of minutes. __________________ This is sig area!

03-29-2011, 04:34 PM	#3
HighlyIntoxicated Confirmed User Join Date: Dec 2009 Posts: 542	I've seen something similar with a content locker, except it blocked users access to the site if they had adblock enabled. Both of these features would be awesome if anyone knows where I could find em.

03-29-2011, 04:35 PM	#4
rowan Too lazy to set a custom title Join Date: Mar 2002 Location: Australia Posts: 17,393	Can you explain the particular functionality on your site in more detail? Does it involve fetching something from the server? If so, you could do that through j/s. Another option would be to redirect to the content/function via j/s, and use <noscript>sorry, you need j/s enabled</noscript> kinda thing. Both could be worked around by someone viewing the source, unless your j/s does some tricky obfuscated calculations to come up with a valid key that your server is expecting...

03-29-2011, 04:39 PM	#5
HighlyIntoxicated Confirmed User Join Date: Dec 2009 Posts: 542	My site isnt doing anything too complicated. I am using a content locker which relies on javascript, if users disable js they are able to get to the content, which is what im trying to fix.

03-29-2011, 05:31 PM	#9
Tempest Too lazy to set a custom title Industry Role: Join Date: May 2004 Location: West Coast, Canada. Posts: 10,217	Difficult to do... Could have some PHP on every page that checks a block IP list... Using the noscript tags, you could call an iframe that adds the IP to the list or maybe set something in a session.. The PHP would have to clear out old IPs/session every so often as well. The check might have to be in an iframe after the noscript one so that the IP/session gets recorded first. Just off the top of my head, something like that. But yeah, the content protection should default to NO ACCESS unless they have javascript enabled.

03-29-2011, 05:57 PM	#11
HighlyIntoxicated Confirmed User Join Date: Dec 2009 Posts: 542	Thanks for the information. At the moment the content locker is doing a fairly good job, with only a few people getting around it, perhaps i'll just ride it out.

03-29-2011, 07:27 PM	#12
camperjohn64 Confirmed User Industry Role: Join Date: Feb 2005 Location: Los Angeles Posts: 1,531	You can ONLY deliver this page: <html> <script> document.location = "realpage.html"; </script> You must enable javascript to see this </html> If the person doesn't have javascript active, it never gets to realpage.html __________________ www.gimmiegirlproductions.com

03-29-2011, 07:30 PM	#13
camperjohn64 Confirmed User Industry Role: Join Date: Feb 2005 Location: Los Angeles Posts: 1,531	If you wanted to get fancy, you could obfuscate the javascript target to go to index.php?page=fbdbe7277d7a77&md5=abb5b2bfbdbe7277 d7a77f7e.php and that page could then do an MD5 checksum on the md5 to confirm it's a valid target page. This would make the hardest of hackers give up and just turn on javascript. __________________ www.gimmiegirlproductions.com

03-30-2011, 05:34 AM	#14
InfoGuy 80/20 Rule Industry Role: Join Date: Apr 2010 Location: Los Angeles Posts: 3,051	Access to your content may not be the primary motive of everyone that blocks scripts. Have you considered the possibility that some surfers block scripts by default to protect themselves from malware? __________________ Support American Heroes \| How Bad is My Batch? \| Vaccine Deaths & Adverse Reactions \| Free Speech Coalition \| <WARNING> ePayService / Guerra Capital, INC / MTACC payments \| Flirt4Free Fucks their Affiliates \| Don't do business with piece of shit Andy Alvarez from Webmaster Central / VR3000, who said: "If it was up to me, they would have shot all 30,000 of those country loving shitheads"

03-30-2011, 06:14 AM	#16
u-Bob there's no $$$ in porn Industry Role: Join Date: Jul 2005 Location: icq: 195./568.-230 (btw: not getting offline msgs) Posts: 33,063	1. Client side 'protection' can always be circumvented. 2. using Javascript print an <img src="/somephp.php"> have somephp.php set a cookie. have your other pages check if the user came from your site (referrer) and if they have the cookie that is set by somephp.php. If they don't have the cookie, they are probably blocking js.

03-30-2011, 07:45 AM	#17
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	i dont get why you dont use css to hide the content.. explain what you are trying to protect ? __________________ hatisblack at yahoo.com

03-30-2011, 08:25 AM	#21
iamtam So Fucking Banned Join Date: Feb 2010 Posts: 1,211	on their first page, use javascript to write a cookie. as they hit enter, read the cookie with php on the inside page. if there is no cookie set, redirect them back to the front page. if they have java turned off, there will never be a cookie, so java is likely disabled.