1

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc).

Usually this is caused by a slow advert or a video, etc. But often there can be critical parts of the page that are not yet being displayed.

Is it safe to interact with the page while it is still loading? By interacting I mean all normal actions on the web, such as clicking links, filling out forms, pressing the back button, etc?

I believe that this can often cause history corruption, however could there be any cases where interacting with the page causes information to be POSTed to the wrong destination, or a hyperlink destination to be incorrect resulting in you accidentally visiting a phishing site, etc?

2

This will be site dependant, however in most cases, yes, it should be safe to interact with a site that hasn't fully loaded. Many sites are designed with priority loading where the most important page elements are loaded first and supplemental elements are loaded in the background. The reason the site are designed this way is so that you can start interacting with the main content without having to wait for the less important data to load. Browsers makers spends quite a lot of their time thinking about how to safely load a page incrementally while all the resources are loading in parallel, and the are features in modern HTML for web developers to control this loading.

It is possible for a poorly designed page to break if you interact before it's ready, however in my experience this is very, very rare in practice. Most sites would hide any elements that can break until it's ready, or show a loading interstitial page if the developer deems it necessary, but the occasions where these are necessary are very rare as most things in HTML and CSS are safe to interact before page load finishes.

In particular, clicking links and back buttons are almost always going to be safe. The developer have to mess up something really, really badly if these very basic actions break their site. Filling forms are usually safe for all simple HTML forms that doesn't use any JavaScript, and even for most firms that do use JavaScript. It is possible though for poorly written forms to mess up, but this is quite rare.

I believe that this can often cause history corruption,

If you're seeing history corruption, that's definitely not caused by interacting page while it's loading.

however could there be any cases where interacting with the page causes information to be POSTed to the wrong destination, or a hyperlink destination to be incorrect resulting in you accidentally visiting a phishing site, etc?

It is possible, but this is rare. The only remotely realistic scenario (one that doesn't involve the developer deliberately going out of their way to make the site vulnerable) I can think of of incorrect POST destination is if an HTML form doesn't specify action attribute but instead uses JavaScript or modifies the action value by JavaScript afterwards. By default, this means that the form will be posted to the same server you're viewing the page on. This may trigger an error but are not normallya security issue. Except for credit card page, because credit card page are often posted directly to third party payment processor so the server wouldn't have to comply with all the requirements of PCI-DSS.

I can't think of any realistic scenario where you'd accidentally post to a phishing site due to incomplete page load. While it's not impossible, the developer would have to go out of their way to make this a possibility.

  • Good answer, although unfortunately many of these best practises rely on sites actually doing things right. I think we all know that the majority of sites (even those of many 'tech' companies) use horrendous bodge-jobs and non-standard practises. – rubberband876 Oct 5 '18 at 12:39
  • 1
    @rubberband876: As a web developer you actually have to work really hard to break a page in this respect. I could easily say that 99.9% of sites wouldn't have any problem with incomplete page load. I never really feel that I have to wait until a page loading indicator finishes to start interacting with a page, since I do that all the time in fact, and I can't recall a single actual incident of it ever causing a problem. – Lie Ryan Oct 5 '18 at 12:51
  • One case I saw was a website where comments needed to be of a minimum length (like SE comments). It turned out it used JavaScript to check that, and in one case where the JS did not load at all (the connection broke mid-fetch), I was able to, completely by accident, send an empty comment. – forest Oct 6 '18 at 3:40
1

If you are refering with "safe" to an established TLS connection I can clearly say yes you are secure on this webpage. Maybe this graphic helps you to understand what's happening at every beginning of establishing a conncetion and get the data: enter image description here

As you can see the key and certificate exchange always happens at the beginning of every session. If you see something your webbrowser got all needed information to start a secure session and only transmit the needed data.

  • 1
    I was referring to the content/DOM rather than transport security, however this is another useful angle. Thank you. – rubberband876 Oct 5 '18 at 12:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.