On both Chrome and Firefox I am unable to reliably block popups without extensions. Though both browsers come with such settings, there seems to be ways to circumvent this behavior.
Now why is that? How are sites able to open pop-ups anyway?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
As a long-term webdev, I've seen this evolve from IE6. This is all by design and consideration actually. Legitimate user-desired actions are not to be blocked. Many corporate portals use popups, as do web-based email, messaging, media players, and more. To developers, "Popups" and "popunders" are unintended and unexpected sub-window openings to be exact. If a site launches a popup, it's because you did something.
The rules for FireFox, Chrome, and Safari are identical: if the popup happens as a result of a user action, like a click or keyboard press, it's allowed. If the popup happens on it's own, it's blocked.
window.open() right away, or else it's blocked. Extensions can block whatever they want, regardless of the user intent, or lack thereof. Links/forms with
target=_blank only fire as a result of user-action, so they need not even be audited.
The site that bypass that settings won't open it on a new tab, but in another window using the command:
window.open. There's also this command
target="_blank" but it only a new tab, (I ain't sure about this) and this kind of command is blocked by the pop up blocker of the browser by default
window.openisn't easily recognised by the blocker, therefore it might open the pop up, anyway the extensions do a better job about it.
Speaking to jQuery specifically, developers have a huge number of triggers that they can use for displaying pop ups, and those popups can take the form of a new tab, new window, creating a new HTML element that displays, displaying a previously hidden/invisible HTML element, and the list goes on...
Again those are very simplified examples with no code to showcase them (check out http://jquerymodal.com/ for a few examples of what modals can do) but the concepts are very real and very much in use in the wild. It's important to note that not all popups are nefarious or spammy and you should use your own judgement and discretion on whether or not to allow/block them on a per-site basis.