<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Really Aced &#187; security issues</title>
	<atom:link href="http://blog.sommestad.net/tag/security-issues/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.sommestad.net</link>
	<description>Web and Cocoa development through the eyes of Kristofer Sommestad, a SWAD developer.</description>
	<lastBuildDate>Sun, 23 Jan 2011 12:21:05 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.1</generator>
		<item>
		<title>Sometimes you&#8217;re just an honest guy trying to script</title>
		<link>http://blog.sommestad.net/2009/05/sometimes-youre-just-an-honest-guy-trying-to-script-2/</link>
		<comments>http://blog.sommestad.net/2009/05/sometimes-youre-just-an-honest-guy-trying-to-script-2/#comments</comments>
		<pubDate>Wed, 27 May 2009 17:04:37 +0000</pubDate>
		<dc:creator>admin</dc:creator>
				<category><![CDATA[JavaScript]]></category>
		<category><![CDATA[javascript]]></category>
		<category><![CDATA[onbeforeunload]]></category>
		<category><![CDATA[onunload]]></category>
		<category><![CDATA[rant]]></category>
		<category><![CDATA[security issues]]></category>
		<category><![CDATA[unload confirmation]]></category>
		<category><![CDATA[usability]]></category>

		<guid isPermaLink="false">http://reallyaced.wordpress.com/?p=97</guid>
		<description><![CDATA[Today, I ran into some JavaScript security issues that cost me a few hours too many of my life. I wanted to show the user a confirmation message when closing a pop-up (OK I know, but sometimes you just got to use them!) to make sure he doesn&#8217;t lose any data when leaving. But we [...]]]></description>
			<content:encoded><![CDATA[<p>Today, I ran into some JavaScript security issues that cost me a few hours too many of my life.</p>
<p>I wanted to show the user a confirmation message when closing a pop-up (OK I know, but sometimes you just got to use them!) to make sure he doesn&#8217;t lose any data when leaving.</p>
<h3>But we can do this! Right&#8230;?</h3>
<p>This isn&#8217;t really any big issue, as the <em>onBeforeUnload</em> event can be used for these exact scenarios, with a nice message too:</p>
<pre style="padding-left:30px;">window.onbeforeunload = function (event) {
    <span style="color:#888888;">// message to display (in between the standard message provided by the browser)</span>
    return "Leaving now will have you lose everything."
};</pre>
<p>The special case here was that I had a SWF running in the window, which needs to be unloaded (close its connections etc) when closing the browser window. That has to be done in the <em>onBeforeUnload</em> event as well, since it&#8217;s too late when we&#8217;re at <em>onUnload</em>.<br />
The problem is that there&#8217;s no way of knowing what the user answered to the question arisen from <em>onBeforeUnload</em>, other than finding out when the event&#8217;s traveled onwards to the <em>onUnload</em> event. By which time it is too late.</p>
<p>So I ended up in a situation where everything was fine if the user decided to keep the browser window open (&#8220;Cancel&#8221; in the confirmation box), but should he close the window &#8211; which is fine too &#8211; I had no way of closing the connections etc in the SWF.</p>
<h3>But why?</h3>
<p><strong> </strong>The reason to this is of course a security matter. Some clever fellas have set some restrictions to what you can do with Javascript to avoid misuse, for example extreme annoyance with pop-up ads or such. There&#8217;s nothing wrong with that.<br />
But sometimes you just want to yell to JavaScript&#8217;s mom and tell her that I&#8217;m a perfectly honest guy trying to make the world better for my users! <img src='http://blog.sommestad.net/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
<h3>What would&#8217;ve helped me</h3>
<p><strong> </strong>So what do I want, then? Well, it would&#8217;ve been nice if I could&#8217;ve gotten an answer from the confirmation box rendered with my custom message (&#8220;OK, leaving now&#8230;&#8221;).<br />
It&#8217;s perfectly fine that the unload event cannot be stopped once the user&#8217;s said &#8220;OK, close&#8221;. But at least I would&#8217;ve wanted the chance to act upon the user&#8217;s choice before the document was unloaded.</p>
<p>So my final solution was just to warn the user that everything was hitting the fan, and at the same point notify my SWF that it was to be unloaded etc. It&#8217;s an OK solution, but not perfect from a usability perspective&#8230;</p>
<p>End of rant.</p>
]]></content:encoded>
			<wfw:commentRss>http://blog.sommestad.net/2009/05/sometimes-youre-just-an-honest-guy-trying-to-script-2/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

