New answers tagged


Sorry, javascript: hrefs are not supported by csp hashes or nonces. I don't think they will ever be supported either. I used to actively participate in the w3c webappsec where csp and hashes were defined and I seem to recall this coming up and the group simply saying that javascript: hrefs need to go away. I could also be misremembering with a bias to my own ...


Client-size (javascript) sanitization doesn't protect you from anything. It's super-easy to bypass it (you can easily do it in firebug or any other web dev toolset). So server-side sanitization and validation is always an absolute must.


This sounds like a business mail scanner, even if they are a UK business they could be using a US based mail server. Some business grade mail scanners do a check of all links in the email to check if they appear to be dangerous before the email is routed to the end user.


To answer the actual question, one way to detect if users are using Lastpass is to provide some type of login field and use jQuery or similar to see if Lastpass has inserted the "background-image" it inserts into the login fields it can autofill. Here's an example of an email input field, all the stuff in the style tag has been added by Lastpass: <input ...


You can use Javascript to detect the typing speed in the username/password fields. A variable rate suggests someone is typing it in manually while a constant rate or even no keystrokes at all (copy-paste) means someone is using a password manager.


Is there any way of identifying whether or not my visitors are using one of these plugins and how best to support it? By far the best way to support password managers is to use normal <form> tags and a normal form. If you don't do anything clever, then the password manager will do its job.


Is there any way of identifying whether or not my visitors are using one of these plugin? Yes. Users can install LastPass as a browser plugin. Thus you can rely on client side scripting languages to check if LastPass is installed. For instance, using NavigatorPlugins.plugins allows you to get the a PluginArray object, listing the plugins installed ...


Most of these password managers are browser plugin based and work by populating the form fields and triggering a form submission as if the ueer pressed the submit button, to the server it appears as a normal form submission, no way to tell if it coming from a password manager.


I have done this in the past and the best way I have found to overcome this has been setting up the application (which for us was a white label customer support portal) on it's own instance of apache configured to handle all traffic from all domains on a particular IP address... EG:,, ... We then ...

Top 50 recent answers are included