Detecting NoScript (not the tag, the extension)
Asked Answered
B

8

16

NoScript seems to be blocking javascript from loading on my site and blocks the login overlays which is very important for the site.

Is there any way I can detect NoScript extension and alert the users?

Edited to add: Looks like a lot of you didn't get me, or maybe I wasn't clear. I'm not talking about the <noscript> tag, but the NoScript Firefox extension, how would I detect if a user has it installed and/or enabled.

Biogeography answered 12/1, 2014 at 8:28 Comment(10)
you can use the noscript tag for alerting the user that he has to enable scripts...Trumantrumann
This might help you : ush.it/2007/10/11/detect-noscript-pocMeador
I already have the <noscript> tag, but NoScript Extension still blocks the JS from loading and the overlay never shows.Biogeography
Unfortunately, the example at ush.it has a broken link.Aeromechanic
+1, indeed a good question. But think about it again. Why should you bother pleasing users with a message, if they by force have decided they wont see "your" ** page for a particular browser? **= only "trusted" pages.Sociable
NoScript obviously blocks any js. So detecting the NoScript extension is not an option. What exactly is the goal? Your premise for the detection being that your login overlay is done in JS. By "do something", do you want to redirect, or present an alternative login link or message?Proconsulate
You should note that since Firefox 23+, JS is almost obligatory: news.slashdot.org/story/13/07/01/1547212/… Technically, if javascript is disabled in Firefox 23+, it implies either the use of Noscript, a Developer extension, or js being disabled using the command line. In that I don't much value in detecting a Noscript extension as opposed to other methods for having javascript disabled.Proconsulate
If you just want to know server-side whether or not it's enabled I've included an easier way in an editMatteson
What are your “overlays”?Historiography
Why do you want to detect NoScript specifically? What if someone writes an extension "BlockScript" which does a similar thing? And then someone else writes an extension "BadScript"? Surely what you want to do is detect if scripting is turned off. And what you really want to do (from your question) is alert the user if scripting is turned off. That can be done by displaying a message (eg. "Please turn scripting on"), and then using javascript to hide that message if scripting is on. That achieves your objective with minimal fuss.Chart
M
21

The method I have used is as follows.

<head>
<style>
  .noscript-error {
    background-image: url(noscript.php)
  }
</style>
<style>
  @import url(chrome://noscript/skin/browser.css);
</style>
</head>
<body>
  <div class="noscript-error">If noscript is NOT installed (and enabled) then Firefox will make a request for noscript.php.
  </div>
</body>

It's pretty self-explanatory. This can confirm if NoScript is not in use. You'll just need to do whatever you choose in noscript.php to set something in the session that says NoScript is disabled.

NOTE: In other browsers noscript.php will always be called, this isn't an issue becaue even if another browser is used and calls noscript.php, it won't be using NoScript as it is for Firefox only. You can do your own magic to avoid this call if you want, but worst edge-case where a user-agent is being spoofed you'll still have an accurate indicator of whether or not NoScript is being used. More info here

Also if you just want to know server-side whether or not JavaScript is enabled you can use

<noscript>
    <img src="noJS.php" alt="JavaScript is disabled" />
</noscript>

In noJS.php you can write a PHP script to render a single transparent pixel (PNG or GIF) and within that script set a session variable, or store the information.

Matteson answered 14/3, 2014 at 19:55 Comment(3)
So far no one has commented, but a few have downvoted. What is wrong with this answer?Matteson
The question is tagged "firefox". Does it support chrome:: URLs?Fatimahfatimid
Yes, chrome: was a thing before Google's Chromium existed.Matteson
F
16

Use a <noscript> block in your HTML:

<noscript>
This site requires Javascript. Please enable Javascript in your browser for this site.
</noscript>
Fatimahfatimid answered 12/1, 2014 at 8:31 Comment(14)
NoScript Extension respects the <noscript> tag, but it still blocks JS.Biogeography
Do you mean it doesn't show the text in the <noscript> tag?Fatimahfatimid
I just tested it, and the text inside the <noscript> tag displayed when I used NoScript.Fatimahfatimid
No, what I meant was NoScript extension will follow the <noscript> tag, and show the text/content inside the <noscript> tags, BUT for an "untrusted" site, it would still block the javascripts (<script src=....)Biogeography
What do you expect? Using NoScript disables Javascript. It would defeat the purpose if there were some way for you to run a script anyway.Fatimahfatimid
This is what the OP needs, but not what the question asks for. So this is semi-correct I guess.Matteson
On the contrary, I'd say it is very correct. There are only two scenarios: javascript enabled or javascript disabled. The OP seems to be a little confused as to what the NoScript extension does. It's the equivalent of checking the "Disabled JavaScript" checkbox in the browser. It simply disables JavaScript by domain/page rather than apply the setting globally across all domains/pages...Oceanic
@Oceanic Regardless, the question is how to detect the NoScript extension. This question does not answer that.Matteson
@Jhawins To detect the NoScript extension, you'd have to run a script. Doing so would render the extension pointless in the first place. The short answer is, it can't be done...Oceanic
@Oceanic it can be done. Then the website can be manipulated server-side. See my answer here https://mcmap.net/q/715986/-detecting-noscript-not-the-tag-the-extensionMatteson
I think they have a reason for their page actually needing to detect the NoScript plugin, hence the reason for such a question! What use is this answer to someone else who wants to detect and report use of the NoScript plugin, otherwise? It says in the header: "detect noscript (NOT THE TAG)".Antiphonal
@Antiphonal please see my answer below. Although this answer is more realistically what the OP should do mine is technically more correct. They're both fine :PMatteson
Yeah I upvoted that just before I posted the message :) I agree, that is the best answer.Antiphonal
I've expanded on your answer... Using it to load an img tag with a php script to set an indicator server-side of whether or not JavaScript is enabled.Matteson
W
2

You could build one page before your normal page with the following code:

<html>
    <head>
        <meta http-equiv="refresh" content="3; URL=http://www.yourpage.com?javascript=false">
        <script type="text/javascript">
            location.href = "http://www.yourpage.com?javascript=true";
        </script>
    </head>
    <body>
        <span>Please wait while the page is loading ...</span>
        <noscript>If nothing happens follow this <a href="http://www.yourpage.com?javascript=false">link</a>.</noscript>
    </body>
</html>

If the user has Javascript enabled he will immediately be forwarded to http://www.yourpage.com?javascript=true and you know he has javascript enabled.

If Javascript is disabled the user will be forwarded to http://www.yourpage.com?javascript=false after 3 seconds by the meta http-equiv="refresh" tag which works without Javascript.

As fallback there is a link for users who have Javascript and other forwarding methods disabled in their browser.

Now you have two seperated pages where you can allow the user to login and work with or without Javacsript.

Notes:

  • This is not specific for NoScript (it will work the same when Javascript is disabled by other means).
  • All users will have a delay when accessing your page.
  • Your URLs contain the javascript parameter which looks kind of ugly. You could use two different pages instead of one page with parameters to hide this.
Wine answered 18/3, 2014 at 16:26 Comment(0)
K
2

That's why NoScript have been made, to block any javascript code on sites. Alert works by js too, so you need some workaround to notify users. You can simply style a modal warning window without JS and remove it, if JS is enabled.

HTML

<div id="js-disabled-warning">
    <div class="message">
        <p>You're using this site with javascript disabled (set by manually or with a browser extension like NoScript)!</p>
        <p>Javascript is essential for using this site. Please enable it!</p>
        <p>Here you can get some help: <a href="http://www.enable-javascript.com" target="_blank">http://www.enable-javascript.com</a></p>
    </div>
</div>

<div class="site-content">
    <p>Here comes your site content!</p>
    <p>Lorem ipsum dolor sit amet, consectetur adipisicing elit. Deleniti inventore velit sint aspernatur nemo quasi in officia doloribus dolores deserunt nostrum quas. Excepturi recusandae eum libero sint necessitatibus corporis id.</p>
</div>

CSS

#js-disabled-warning {
    position: absolute;
    top: 0;
    left: 0;
    right: 0;
    bottom: 0;
    margin: auto;
    background: rgba(0,0,0,.5);
}

#js-disabled-warning .message {
    position: absolute;
    top: 0;
    left: 0;
    right: 0;
    bottom: 0;
    margin: auto;
    display: table;
    width: 30%;
    background: #bada55;
    padding: 20px;
    border-radius: 5px;
}

And JS to remove the message

(function() {
    var alert_modal = document.getElementById('js-disabled-warning');
    alert_modal.parentNode.removeChild(alert_modal);
})();

With the addon enabled, this script won't run and your message is shown.

Here's a fiddle for it: http://jsfiddle.net/X7q9F/

Kalagher answered 19/3, 2014 at 11:17 Comment(0)
S
1

Since the <noscript> content is only shown when JavaScript is disabled, you can't use an alert (since it's, well, JavaScript). If you need to call attention to the fact that the site requires JavaScript in order to operate properly, you're going to need some CSS.

One possibility is to stick a <link /> tag in the <noscript> that loads a CSS file containing rules to hide everything except the error message. An extremely simple example (which just uses an embedded <style> tag):

<html>
    <head>
        <meta charset="utf-8" />
        <title></title>
        <link href="http://netdna.bootstrapcdn.com/bootstrap/3.0.3/css/bootstrap.min.css" type="text/css" rel="stylesheet" />
    </head>
    <body>
        <div class="container"> 
            <noscript>
                <style>
                    .noscript { display:none; }
                </style>
                <div class="alert alert-danger">
                    <b>Sorry!</b> This site requires JavaScript. Please enable it in your browser.
                </div>
            </noscript>
            <div class="noscript">
            <p>
            Lorem ipsum dolor sit amet, consectetur adipiscing elit. Mauris id blandit lacus. Nulla tempus ornare arcu vel iaculis. Duis sit amet interdum enim, sed molestie massa. Proin in leo nunc. Nullam justo felis, consectetur sit amet sapien ut, feugiat tincidunt arcu. Ut dignissim, nisl ut placerat interdum, odio nibh euismod ipsum, nec placerat est est tempor erat. Curabitur in ligula sed enim eleifend fermentum. Duis sit amet adipiscing eros. Mauris lacinia ut tortor sed accumsan.
            </p>
            <p>
            Curabitur libero risus, sagittis sed urna ut, molestie fermentum enim. Donec fringilla pharetra neque sed ullamcorper. Phasellus ante lacus, rutrum eu ligula eu, mattis tempor metus. In tincidunt arcu non enim rutrum, at fringilla eros mattis. Nulla facilisi. Mauris eu elit id tellus ornare sollicitudin quis nec lacus. Curabitur aliquam porttitor enim, pretium vestibulum felis tristique id. Donec dictum congue turpis, sit amet dictum purus placerat quis.
            </p>
            <p>
            Curabitur quis nulla consequat, adipiscing quam eget, vulputate nulla. Pellentesque elit ante, sagittis vitae magna id, adipiscing aliquet purus. Phasellus eros tellus, eleifend sit amet tellus vel, porta ultrices elit. Vestibulum tincidunt, ligula in gravida mattis, nulla mi blandit nulla, hendrerit sodales erat mauris sit amet nulla. Morbi congue imperdiet mi, vitae vulputate neque euismod a. Pellentesque consectetur, diam vel feugiat elementum, arcu enim faucibus risus, ut tempor leo magna sit amet augue. Donec justo nisi, lacinia et risus at, dapibus ultrices risus. In consequat felis id lectus dictum ornare. Proin egestas tortor urna, sed vehicula sapien gravida vitae.
            </p>
            </div>
        </div>
    </body>
</html>
Scales answered 12/1, 2014 at 9:41 Comment(2)
Maybe you didn't get me either. I'm not talking about the <noscript> tag, bu the NoScript Firefox extension, how would I detect if a user has it installed and enabled.Biogeography
I understood what you were referring to. I just don't think you have any other option, since feature detection, alerts, and redirects require scripting. This forum post seems to imply that <noscript> is an expected fallback: forums.informaction.com/viewtopic.php?f=10&t=18954Scales
C
1

As far as I know, it's impossible to detect the NoScript extension specifically. I assume you want to display customized messages to users who have NoScript and to users who simply have JavaScript disabled, but this is unfortunately not possible.

A good way to handle this is to display some kind of alert message in <noscript> tags saying something along the lines of "You must enable JavaScript to use this site."

People who have NoScript installed will know what that means and will disable it accordingly.

Cornemuse answered 17/3, 2014 at 22:15 Comment(1)
Please see my answer for future referenceMatteson
L
0

NoScript will block all JavaScript. So simply hide the warning message with JS and if it's still present, NoScript is enabled (or JS generally disabled).

<html>
    <head>
        <title>test</test>
    </head>
    <body>
        <div id="noscript">Warning! You have disabled JS or you're using NoScript which will break this site! Please active JS or deactivate NoScript to continue.</div>
        <div id="content">
            ...
        </div>
        <script type="text/javascript">
            document.getElementById('noscript').style.display = 'none';
        </script>
    </body>
</html>
  • User without NoScript enters your page -> the JS is executed and the message is hidden.
  • User with NoScript enters your page -> the JS is not executed and the message won't be hidden.
Libava answered 18/3, 2014 at 15:33 Comment(0)
C
0

NOTE: I have installed the Firefox NoScript extension to test this solution and it does work properly.

Noscript is primarily a security plugin so detecting or overriding Noscript is not an option.

Since you have no Javascript in that scenario you will need to rely on the static HTML/CSS to inform the user then use javascript to remove the notification.

<html>
<head>
  <title>noscript detect</title>
</head>

<body>
  <div id="noJavascript">
    Your browser does not have javascript enabled. This site
    requires javascript to operate properly. Please enable
    javascript.
  </div>
  <script type="text/javascript">
   var noJavascript = document.getElementById("noJavascript");
   noJavascript.parentNode.removeChild(noJavascript);
  </script>
</body>
</html>
Calfee answered 19/3, 2014 at 13:16 Comment(4)
Uh, you do know that <noscript> tag would do the exact same thing?Furfuraceous
All you do is remove #noJavascript if javascript is turned on?Furfuraceous
Well, what is the point? Noscript tags shows up if javascript is disabled, and doesn't if it isn't`Furfuraceous
The point is not to replicate the <noscript> functionality. The point is to 'detect' the Firefox NoScript extension. Perhaps you're not understanding the context of the original question.Calfee

© 2022 - 2024 — McMap. All rights reserved.