Is it safe to assume Javascript is always turned on?

Question

Duplicate:

Do web sites really need to cater for browsers that don’t have Javascript enabled?
Only supporting users who have Javascript enabled.
How common is it for Javascript to be disabled
How many people disable Javascript?

I've been doing web applications on and off for a few years now and each application I write seems to have more javascript than the previous one.

A frequent comment is: "But what if the user turns off Javascript?".

I take the point, but I've never actually seen a user do this. Not once.

Have you?

Answer 1

Yes, it happens.

NoScript is a Firefox add-on - downloaded by plenty of people.

No Script

Answer 2

You should always make sure your site works without javascript.

People turn javascript off for security reasons. Companys sometimes have javascript forced off at their inhouse computers. Also spiders don't have javascript so your site not working without javascript is bad SEO practice.

Answer 3

It depends entirely on what sort of coverage you require.

Do you need 80% 90% 100% of users to be able to use your site / application?

People DO turn off Javascript. The question is, does your site need to work for those people? Can it just tell them to turn it on if they want to continue?

Answer 4

5% of users have JavaScript turned off.

Answer 5

This comes up about every other week or so. Did you search first?

See these:
http://stackoverflow.com/questions/121108/how-many-people-disable-javascript
http://stackoverflow.com/questions/379735/how-common-is-it-for-javascript-to-be-disabled
http://stackoverflow.com/questions/740243/only-supporting-users-who-have-javascript-enabled
http://stackoverflow.com/questions/822872/do-web-sites-really-need-to-cater-for-browsers-that-dont-have-javascript-enabled

The main points are:

• Google doesn't use javascript when indexing
• Mobile browsers (smart phones like the iPhone) sometimes have bad or non-existent javascript
• Screen readers don't do javascript well, if at all, and many developers are legally required to support them.
• Thanks to filters like NoScript, the number of people browsing with javascript disabled (at least initially) may actually be going up.

So yes, you still need to worry about it.

Answer 6

It has become a standard at my office (for better or for worse) to assume that the user has JS installed and turned on. The number of people who have it turned off is getting smaller and smaller every day, but this still doesn't mean that you should forgo performing the necessary validation for submission on the server side as well just in case (as well as some other scenarios).

Answer 7

It's rare, but it happens. It really depends on who your user base is. If it's for corporate users, a lot of them have default security settings with javascript disabled. If it's for... pretty much anyone else, odds are they'll have it turned on.

Answer 8

I would say that it is not safe to assume javascript is always on, but it is safe to REQUIRE javascript be turned on.

In other words, you don't need to jump through hoops to make something work without it, just display a message or redirect.

Javascript is an essential technology, and it's not unreasonable to require it.

Answer 9

It's rare, but it's possible. If you are launching an application for "everyone" to use on the internet, then yes, you'll have to prepare for such an event. It really depends on your target audience, but the safest assumption is that someone will have it turned off.

From a security perspective, you definitely need to handle this situation, as turning off JavaScript (or worse yet hijacking the scripts you wrote) is an easy to bypass business logic and validation, if it isn't double checked on the server. Requiring it to be turned on is not a good enough defense for stopping people in this situation. Remember you're requesting that the browser tells you what it enabled and disabled. The user (or attacker in this case) is in control of the browser, and you can't trust what it says as it's easy to modify the HTTP headers.

Answer 10

I run by default with javascript off for new sites (NoScript) plugin. I think many tech-savvy users do the same. At least the ones who are paranoid about XSS attacks.

Answer 11

Depends on who your target audience is. Some users turn off JS for various reasons. Usually, they will enable it for individual sites that need it, but they might not do that if you don't tell them they need it.

If your site just fails to load correctly, they'll assume it's broken. If it shows a "you need JS to view this page" message, then at least they'll know what to do.

Some will then enable Javascript for your site specifically, but some won't, and they simply won't be able to use your site, unless it is functional without Javascript.

Answer 12

It is best practice to code for users that have JavaScript turned off.

As web developer your goal should be to provide the core basic functionality (without JavaScript). This enables all users to fully use your site. Then through the use of JavaScript, in a process known as "progressive enhancement", spruce up elements of the site for users that have JavaScript turned on.

And in the case where JavaScript is off...your site should gracefully degrade.

Web development is one of those arenas where you can't expect anything. Code for all users to maximise your site's accessibility.