4

The latest versions of most web browsers have implemented a feature to prevent javascript from closing current window or tab.

Firefox window.close() method

This method is only allowed to be called for windows that were opened by a script using the window.open() method. If the window was not opened by a script, the following error appears in the JavaScript Console: Scripts may not close windows that were not opened by script.

Same thing applies to Internet Explorer and Chrome but I couldn't find an official document for them about this feature to link here.

My question is "Why do browsers prevent javascript from closing current window unless that window was opened via a script itself? What types of attacks or abuse cases is this feature defending against?"

  • 4
    Mostly, it was really annoying! You used to be happily browsing around, visit a "joke" page unwittingly, and your browser would close, losing your history and killing any downloads in progress. – Matthew Apr 11 '16 at 12:03
  • @Matthew Even if this is allowed, the joke page will only be able to close that tab, not the entire browser. The "window" in JavaScript sense refers to a tab in browser sense, so the attack you are referring to is not a valid point. – Franklin Yu Jul 11 at 20:10
3

The reason this limitation is enforced, is that the SOP policy does not apply to window.close(), instead, you can actually close any window. It would be impossible to apply the SOP policy to window.close() as normally, each window in a browser process is isolated from each other to prevent certain cross-boundary attacks, thus even your "own windows" would be in a different SOP scope.

A common process where this are used, is in a payment process, where the webshop site popup a window for payment, and then when the webshop site detects that payment is complete, the window is closed.

To prevent abuse of this feature to for example close down other site's windows, the limitation is set that only windows opened by a script may be closed.

In the circumstances you want to log out or move away a user from the page, the normal action is to enforce non-cacheability and then use window.location.href instead to move the user to a "logged out" page.

  • thus even your ‘own windows’ would be in a different SOP scope” could you please explain more about this, maybe with example? This is really confusing. – Franklin Yu Jul 11 at 20:12
0

Notably, to prevent sites that suffer from XSS flaws to be "auto-closed" by malicious scripts. Though script-opened pages would still suffer from the issue..

One could argue that 'any XSS-prone site could be defaced anyways'.

True, but as Matthew commented, at least you would not "lose" your history (which could be easily restored at the price of a few clicks), and, possibly, current downloads (note that modern browsers now pop-up a "are you sure to cancel your download ?" message, but that was not the case before)

  • 2
    I doubt they had XSS in mind when designing the feature. It was simply to stop sites from destroying your history at will. It makes sense if a popup can be closed by script, however a site attempting to close your main browser window shouldn't be allowed. – SilverlightFox Apr 11 '16 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.