Simon Willison’s Weblog

Why do some people disable JavaScript in their browser?

25th August 2010

My answer to Why do some people disable JavaScript in their browser? on Quora

For security reasons.

Many (most?) web applications have security vulnerabilities due to JavaScript. The most common are XSS, where malicious JavaScript can be injected in to a page, stealing cookies and forcing users to perform actions that they did not intend, and CSRF, where unprotected forms can be abused to again perform unintended actions.

It’s amazing how many developers are unaware of CSRF—and quite a lot still don’t fully understand the consequences of XSS.

Disabling JavaScript in your browser makes the above attacks much harder to pull off. Once you understand how serious and widespread these problems are, it becomes very tempting to disable JavaScript for unknown sites and only enable it for sites you think have extremely skilled development teams.

That said, I don’t personally disable JS in my browsers—but that’s only because I haven’t been bitten badly yet.