14

I have a webpage I would like to use locally (the JSON-LD Playground). It appears to be designed to operate without connecting to a server. I would like to have a strong confidentiality guarantee for the data I put in it. Is there a way to prevent javascript in a browser from doing anything that can communicate with the internet (e.g. loading additional images or requesting documents via the Fetch Api).

The best approach I've come up with so far is simply to be disconnected from the internet while using it and then closing the browser before re-enabling the internet. However, this is a cumbersome process. Is there a better process? My intent is to download the page and all of the scripts it references locally and then do whatever additional steps are needed to put the page in a sandbox.

4
  • 2
    For your particular use case, the JSON-LD playground is open source so you may just host it yourself locally
    – Bergi
    Commented Jun 10 at 19:25
  • Worth considering that any browser extensions you have installed might still have access to the content you're pasting into your local copy of JSON-LD Playground... potentially even storing that data in localStorage for future retrieval and transmission when the browser does have internet access. I like other's suggestions of using a special sandboxed browser instance for this purpose. Commented Jun 11 at 18:22
  • I'm also sceptical about the claim that the application works without any network connection at all. Have you actually tested this, Cort Ammon? With an empty browser cache? As stated in my answer, the application constantly loads schemas from schema.org. That obviously doesn't work in offline mode, so you'll get flooded with errors. Of course you could redirect schema.org to some local server if you already know all schemas you'll ever need, but then you still need network access.
    – Ja1024
    Commented Jun 12 at 6:53
  • @Ja1024 I wasn't paying attention to brower caches, but it did work with the computer disconnected from any network. Or at least the features I was looking at did. If there were some schema.org supported features that silently failed, I did not notice them.
    – Cort Ammon
    Commented Jun 13 at 3:39

5 Answers 5

14

Firefox has an offline mode, just press “alt” to reveal the file menu, and select “Work offline”. Combine this with private browsing to make sure nothing is kept in storage for later.

If you want to use Firefox for browsing in parallel, you can create a separate profile for it. To do this, just launch it with

firefox -P

Combine with -private to start in private browsing mode. Add a profile name behind the -P to select a specific profile automatically.

There also seems to be an undocumented -offline option, so if you create a profile named “test”, you can start it in both offline and private modes with

firefox -P test -offline -private
5
  • 1
    That's a really nice feature! Thank you for pointing out out. I actually didn't know that menu (made visible with 'alt') was even there!
    – Cort Ammon
    Commented Jun 11 at 1:29
  • These days -no-remote is no longer required to multi-instance with separate profiles, and I'd actually recommend against it: it breaks things like desktop notifications.
    – Bob
    Commented Jun 11 at 1:41
  • @Bob thanks for the info, I have removed it from the answer
    – Didier L
    Commented Jun 11 at 9:14
  • You might want/need -new-instance instead of -no-remote.
    – allo
    Commented Jun 11 at 16:24
  • @allo -new-instance also does nothing particularly useful (ref): all it does in modern Firefox is change whether an error is shown if you attempt to re-use the same profile. The only requirement to launch a separate profile is to simply specify the profile with -P, since Firefox 67 fixed remoting with multiple instances.
    – Bob
    Commented Jun 12 at 8:30
9

You can use Firejail to sandbox a particular Firefox instance. This allows you to restrict network access, ranging from no access at all to forcing all traffic through a firewall for more fine-grained rules. Alternatively, you could run Firefox in a container (like Docker) or virtual machine. The latter two options are more heavyweight, though.

Setting up a local copy of the playground application is definitely a good idea. Since the code is open source, you don't have to scrape the files.

Note that the application makes requests to schema.org for downloading schema information, so disabling network access entirely may be tricky. However, you can fix this with a firewall, or download all necessary schema files in advance (if you know what you'll need).

9

You can use an addon like uMatrix that injects CSP headers to prevent cross-site network requests.

1

Is there a way to prevent javascript in a browser from doing anything that can communicate with the internet (e.g. loading additional images or requesting documents via the Fetch Api).

Content Security Policy is a method to limit which resources a webpage can load. This can effectively prevent "loading additional images or requesting documents via the Fetch Api", but it is not perfectly watertight against data exfiltration. In particular, malicious JavaScript can create a <a> link tag with a URL that contains some sensitive data and click that link using JavaScript.

Isolated Web Apps somewhat do what you want. You install an IWA once and after that its integrity is protected. Again, if it contained malicious code when it was installed it can still exfiltrate sensitive information.

1
  • 1
    Content Security Policy (CSP) does only work if you control the server, or , as an alternative, the HTML code, for some directives. The OP, in the original setup, does control neither.
    – Marcel
    Commented Jun 11 at 13:30
1

Most browsers, including Google Chrome and Firefox, support an offline setting in the F12 developer mode.

While this is not targetted at the casual user, it's easy to temporarily set. See https://stackoverflow.com/a/29326005/79485 for example with Google Chrome.

1
  • This. Devs need to be able to test their offline functionality, and browsers need to support it in the devtools. Commented Jun 11 at 14:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .