Require site visitors to enable Javascript
This one has dogged me for quite some time, but I finally figured out how to force users to turn on Javascript when using sites with a lot of mission critical Javascript logic.
Let me first begin by acknowledging that, yes, requiring Javascript flies in the face of site accessibility. Policy wonks for this sort of thing will tell you that Javascript should never be a necessity, that a page should “degrade gracefully” when Javascript isn’t enabled. This mindset is complete crap, in my opinion. Every site has a minimum browser requirement, and Javascript is built into every modern browser. I fail to see why we are still separating the two, and can make a darn good case for expecting Javascript on the user’s end. But that argument’s for another day. If you agree with me, read on.
The example
This example assumes you understand HTML, CSS, and Javascript, and makes use of jQuery, so you may have to adapt it to fit your Javascript framework of choice.
This technique could be applied across the board to an entire site, but let’s start with a single page. A login or account registration is a great choice, since they are already gateway pages to your site. Start by adding the following CSS definition to your page or stylesheet:
.enable-javascript{ display:none }
Next, open the HTML for your page and add the enable-javascript CSS class to the top level container containing the body of your page. You should try to leave the header and footer (and their accompanying navigation links) visible and accessible. For example, after my header DIV, the body of my pages are typically wrapped in something like this:
<div id="content" class="enable-javascript"> [...] <div class="base"></div> </div>
At this point, you’re looking at a blank page. Now let’s give our non-JS users something to look at. Place a <noscript> code block outside and above the body that you just hid. You can use CSS and elaborate HTML inside a <noscript> block, so feel free to make it look good. I actually duplicate my body wrap HTML so the look is similar:
<noscript>
<div id="content" class="enable-javascript">
Javascript is not currently enabled in your browser. <a href="http://www.google.com/support/bin/answer.py?answer=23852">You must enable Javascript</a> in order for this site to work properly.
<div class="base"></div>
</div>
</noscript>Finally, make sure the jQuery library is loaded, and add this bit of code to the Javascript for your page:
$(function(){ $('.enable-javascript').show(); });
What’s happening
We’re using the absence of Javascript to halt the user’s access to a page. By default, page content is hidden via CSS, and we use Javascript to reveal it. If the user’s browser does not have Javascript enabled, the reveal never happens. Visibility for the <noscript> block is handled automatically by the browser, depending on whether Javascript is running or not.
A live example
I’m using this technique on the Fwd:Vault login page. In order to see it in action, you obviously have to disable Javascript. You can use the Google support link to turn Javascript on, and Firefox users can use the Web Developer toolbar add-on to do this a little more efficiently.
A couple caveats
Javascript is a client-side language; it actually lives inside the user’s browser, and runs from the user’s machine. Javascript code essentially tells the browser to manipulate the static HTML of the page, and the server isn’t involved in the process at all (AJAX is something of an exception). This means that there is absolutely no way for us to look for Javascript on the server side using PHP or other server-side technologies.
In addition, since Javascript control is firmly in the hands of the user, you cannot trust Javascript for security. Your average user will be stopped dead with this technique, but hackers and code monkeys can easily circumvent it. This is the case with all Javascript effects, and all have the same countermeasure: scrub all incoming data regardless of Javascript rules enforcement.
Feel free to post comments or questions, and please link your own examples if you put this technique to use!






Data security without software or hardware