I am creating a website which solely uses REST api for all the features and functionality, from signup and login to fetching data and populating the webpage using Mustache as template engine for objects.

Authentication is token based in which token dynamically added to header using JS functions to prevent CSRF attack. All the functions when interacting with user input data has sanitizers to prevent XSS attack. So basically every valid action has an associated JS function associated with it with XSS and CSRF protection enabled.

What if a user want's to bypass these functions and run his own functions from the console performing the same actions without XSS protections. One option is to implement server side XSS protection.

Now what if someone tries to trick users to paste some JS code in console which essentially has access to authentication tokens and can perform undesired requests which can harm the user. How to mitigate this attack or is there a way to prevent or identify such actions?


4 Answers 4


what if someone tries to trick users to paste some JS code in console

What if someone tricks users into installing malware on their computer?
What if someone dials a fake tech support number after encountering an issue with your website, and the scammers do something evil to the user's account on your website?
What if people on 4chan post about fast, wireless charging smartphones in a microwave, and people actually try it and destroy their phone?

I think this falls in the category "outside of your control", at least as far as technical measures go.

Injecting custom code into a developer's console is not something you can effectively protect against, unless it's within your own (or a client's) company and you can impose/recommend a company policy to disable the console in browsers for non-developers or something. And even then, it's probably more of a nuisance to legitimate users than truly useful.

What you can do is educate and inform people. It's not limited to self-XSS: if I ask you to paste some code into a text file and rename it to vbs, then you have the exact same issue. Running untrusted code is the problem here, not just the trendily-named self-XSS.

  • I agree. I would like to add on top of that, that some sites (Facebook for example) add a visual warning to console whenever user opens it, which could help the OP out in his combat. You can check out Console API reference page for more information.
    – FanaticD
    Apr 13, 2018 at 9:23
  • @FanaticD same with Linode (see the console) Dec 14, 2019 at 22:54

There is no way to distinguis an API call made from the "real" app from one made from the console. The server only sees the HTTP request, and it looks exactly the same. There really isn't anything you can do here.

Self XSS is not a vulnerability in your site, and hence you can not fix it. It is a vulnerability in the browser, or perhaps rather in people. The ones who can make a difference here are the browser vendors - and in fact, they have. The first time you fire up the console (at least in Firefox), it gives you a warning explaining that this is a dangerous place and you should not just copy paste things here.


Some sites like facebook print a big fat warning on the developer console (I think just using console.log) explaining users that they should never ever paste code there.

  • This was the answer that first came to mind - if it's an issue that arises solely out of user ignorance, you have to attack the ignorance. Mar 19, 2018 at 17:10

Like what Luc has said, it is impossible to completely prevent XSS, or anything security-related actually.

However, unlike the other answers which state that you only can display a visual warning using console.log(), it is actually possible to disable the console altogether - see this post for the full details. It is a bad idea to rely on client-side protection against XSS though.

Using this code from the linked post, you'll be able to disable the developer console on the client-side:

Object.defineProperty(window, "console", {
    value: console,
    writable: false,
    configurable: false

var i = 0;
function showWarningAndThrow() {
    if (!i) {
        setTimeout(function () {
            console.log("%cWarning message", "font: 2em sans-serif; color: yellow; background-color: red;");
        }, 1);
        i = 1;
    throw "Console is disabled";

var l, n = {
        set: function (o) {
            l = o;
        get: function () {
            return l;
Object.defineProperty(console, "_commandLineAPI", n);
Object.defineProperty(console, "__commandLineAPI", n);

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .