I have a <script> in the <head> of an HTML file that checks to see if the user is authorized to view the page's contents through a token cookie. The <script> is tagged with defer and immediately redirects the user if they are not authorized. Would a user or a bot be able to remove the defer tag and allow the page to load? Is there a better way to ensure a user is authorized before the page loads?
Can a user modify remove a `defer` tag of a script that redirects them
50 views Asked by agctute At
1
There are 1 answers
Related Questions in JAVASCRIPT
- Using Puppeteer to scrape a public API only when the data changes
- inline SVG text (js)
- An array of images and a for loop display the buttons. How to assign each button to open its own block by name?
- Storing the preferred font-size in localStorage
- Simple movie API request not showing up in the console log
- Authenticate Flask rest API
- Deploying sveltekit app with gunjs on vercel throws cannot find module './lib/text-encoding'
- How to request administrator rights?
- mp4 embedded videos within github pages website not loading
- Scrimba tutorial was working, suddenly stopped even trying the default
- In Datatables, start value resets to 0, when column sorting
- How do I link two models in mongoose?
- parameter values only being sent to certain columns in google sheet?
- Run main several times of wasm in browser
- Variable inside a Variable, not updating
Related Questions in HTML
- How to store a date/time in sqlite (or something similar to a date)
- How to use custom font during html to pdf conversion?
- Storing the preferred font-size in localStorage
- mp4 embedded videos within github pages website not loading
- Scrimba tutorial was working, suddenly stopped even trying the default
- Is there any way to glow this bulb image like a real light bulb
- With non-graphical maps in Leaflet, zoomDelta doesn't work
- What can I do to improve my coding on both html and css
- Uncaught TypeError: google.maps.LatLng is not a constructor at init (script.js:7:13)
- Bootstrap modal not showing at the desired position on a web page when the screen size is smaller
- Displaying a Movie List on a Website Using Jinja2 and Bootstrap
- How to redirect to thank you page after submitting a Google form embedded into a Google Site?
- Storing selected language in localStorage
- Fences (parenthesis, braces) in HTML and MathML
- Understanding Scroll Anchoring Behavoir
Related Questions in HTTP
- Handling both JSON and form values in POST request body with unknown values in Golang
- Why can't I use PUT requests?
- nginx set up reverse proxy from subfolder to a port
- Async Web Server RP2040 returning ERR_CONNECTION_REFUSED?
- Getting `FormatException: Missing extension byte (at offset 6)` exception for accessing `response.body` from a server deployed in Vercel
- Retrieving list of values from MYSQL data base based on input value(LARAVEL 10 )(GET HTTP METHOD)
- Unable to add request headers via CHttpFile - C++/MFC
- Why do we call all http services 'Web Api/Web Service'?
- How to correctly read POST REQUEST body on ESP32?
- on linux gitclone issue remote server error showing fatal error with proxy n port
- Elasticsearch - cascading http inputs from Airflow API
- How to clean the html pages opened in a session?
- UTF-8 is not a valid encoding name
- I dont get the Result i expected when i want to get my Telegram Chatbot id
- NextJS 14 SSE with TransformStream() sending messages in a single response
Related Questions in DEFERRED
- Pdf signing using USB device
- Why isn't the defer working in this case on my laravel project?
- What's a difference between "on" and "when" in the new angular defer block
- How to use @defer in angular component many times in the same page
- How can I use async pipe with @defer to load and declare variable in template in Angular 17
- Why does calling grecaptcha.render() multiple times load Google's ReCAPTCHA library multiple times?
- Looking for examples of product demonstrating real life application of Deferred callbacks (thread safe) system
- Can a user modify remove a `defer` tag of a script that redirects them
- django: How to defer TextField and localized variants of field from queryset including related models
- Script with defer prevents loading of Angular App
- "Finally" equivalent for Swift?
- Alternative for deferred length character arrays in common blocks? (crashes gfortran)
- Understanding deferring macro
- Flutter Failed to build appbundle when using DeferredComponent
- Again Facebook Deferred link always return nil
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
Popular Tags
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
A user can absolutely bypass your mechanism. Likely in less than 30 seconds. You should never, ever, and I mean never, use the client side to be sure whether the client is logged in. Let's say the user simply disables JavaScript. No more redirection. Because the code is run on the user's computer, they can modify the code however they want.
The correct way (in your specific situation, things get different in other approaches) to do this is from the server. Use session, JWT, or some other auth mechanism, from the server. Redirect your client from the server. Only send data to the user if they are logged in.