Security feature: Preventing javascript from closing the window

Question

The latest versions of most web browsers have implemented a feature to prevent javascript from closing current window or tab.

Firefox window.close() method

This method is only allowed to be called for windows that were opened by a script using the window.open() method. If the window was not opened by a script, the following error appears in the JavaScript Console: Scripts may not close windows that were not opened by script.

Same thing applies to Internet Explorer and Chrome but I couldn't find an official document for them about this feature to link here.

My question is "Why do browsers prevent javascript from closing current window unless that window was opened via a script itself? What types of attacks or abuse cases is this feature defending against?"

Answer 1

The reason this limitation is enforced, is that the SOP policy does not apply to window.close(), instead, you can actually close any window. It would be impossible to apply the SOP policy to window.close() as normally, each window in a browser process is isolated from each other to prevent certain cross-boundary attacks, thus even your "own windows" would be in a different SOP scope.

A common process where this are used, is in a payment process, where the webshop site popup a window for payment, and then when the webshop site detects that payment is complete, the window is closed.

To prevent abuse of this feature to for example close down other site's windows, the limitation is set that only windows opened by a script may be closed.

In the circumstances you want to log out or move away a user from the page, the normal action is to enforce non-cacheability and then use window.location.href instead to move the user to a "logged out" page.

Answer 2

Notably, to prevent sites that suffer from XSS flaws to be "auto-closed" by malicious scripts. Though script-opened pages would still suffer from the issue..

One could argue that 'any XSS-prone site could be defaced anyways'.

True, but as Matthew commented, at least you would not "lose" your history (which could be easily restored at the price of a few clicks), and, possibly, current downloads (note that modern browsers now pop-up a "are you sure to cancel your download ?" message, but that was not the case before)