I played with Eslint and eslint-scanjs security plugin and came across the check 'property_geolocation'. The source code of the check is:

"use strict";

module.exports = function (context) {

  return {
    "MemberExpression": function (node) {
      if (node.property.name == 'geolocation') {
        context.report(node, "geolocation can be unsafe");


so it gives no clue about why it's dangerous to use the property. Can anyone explain what risks of using the 'geolocation' property and how it can be abused?

  • 1
    Research the commit logs of this rule and maybe ask on their issue tracker?
    – billc.cn
    Dec 12, 2016 at 14:24

1 Answer 1


According to the Mozilla documentation and caniuse.com, some browsers will allow geolocation to be served over HTTP, in which case the usual risks of a MITM apply.

This is a guess on my part, but if an attacker can uncover your physical location, they could exploit it in any of the following ways:

  • Find your home/work addresses, and use that for any of the following:
    • knowing when it's safer to break in or when's the best time to swat you.
    • framing you for possessing illicit material (as (nearly) happened to Brian Krebs).
    • covering their tracks.
  • Use it to create more targeted phishing attempts (we know that Pilib Uí Rólaun regularly goes to Bank A on the main street of Ballycac - so, he's more likely to fall for a request to log into this than for Bank B).
  • Sell it to a third party that might find it useful (for any of the above reasons).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .