0

If content is hidden on a web page using a CSS hidden directive (consider this example of hiding the Sharepoint 2013 Share button with CSS).

What techniques allow the user to circumvent that and access the function being hidden? In other words, in essence click the "forbidden" button anyway.

In this case I am particularly interested in content which is made possible on the website via javascript in some way, rather than simply hiding a link or form submission which seems trivial to reveal.

6
  • I'm not sure exactly what you are trying to get from this question, but if it is a way to prevent against accessing hidden content, I don't believe it is possible. Security by obscurity is not really security at all. Absolutely preventing a button being clicked must rely on server side validation, or not putting the button on the page in the first place.
    – Hearth
    Nov 16, 2015 at 23:37
  • @Hearth, I completely agree. I'm looking to find some information on what it takes in this context though. I never thought it wasn't possible to circumvent.
    – Yishai
    Nov 16, 2015 at 23:39
  • any CSS directive can be over ridden with the developer view in the browser .... or Fiddler, or Burp, or ....
    – schroeder
    Nov 17, 2015 at 0:19
  • Rule of Thumb: anything sent to the client cannot be trusted. You hide things or provide validation merely as a convenience, but you can never trust that the data has not been tampered with. If you want to hide something, do it server side (permissions, authorization, etc.)
    – schroeder
    Nov 17, 2015 at 0:21
  • As web developer I can confirm what has already said. CSS "display:none" rule only prevent an element to be shown but the element is present in the HTML code. You only need to remove that rule (using dev tools included in all browsers) and that's it (it takes few seconds and very basic css knowledge).
    – lepe
    Nov 17, 2015 at 0:42

1 Answer 1

2

Simply using the developer tools built into many browsers should be enough. Also it is probably easy to write some bookmarklet to show "hidden" parts of the page.

Hiding with CSS is not a security feature (not even security by obscurity) but should only be used to hide some parts of the page for now, i.e. show a summary and hide details until the user wants to see them. Parts simply hidden with CSS are usually indexed by search engines too.

Not the answer you're looking for? Browse other questions tagged .