Keep Firefox’s location bar on sight
Some pop-up windows may hide the location bar for a number of valid good reasons like providing a less cluttered interface or a smaller window, but it is also an easy cover for malicious web sites to hide the real location of fake sites in cross site scripting (XSS) attacks.
Michal Zalewski, the hacker who uncovered a handful of security vulnerabilities in Firefox on last February, pointed it as one of Firefox’s weaknesses. Fortunately, as suggested in the bug discussion, this behavior can be changed to forbid the ability to hide the location bar to all web sites.
To do this:
- Enter about:config in the location bar
- Look for dom.disable_window_open_feature.location
- Double click it to toggle it to true
You are done. Now popups will show the location bar always. It may look weird at first but it’s a smal price to pay for additional protection.
Comments
Percy Cabello
Cameron it works for me: http://www.mozillalinks.org/images/locbarblocktest.png
I didn’t need to restart, but guess it wouldn’t hurt you try.
Ryan.Havvy
Note: Havvy isn’t my last name.
Anyways, that function should be turned by default, no? I do know that Internet Explorer also lets that address bar being seen. So, a rare 1-UP over Mozilla from Microsoft.
Great find none-the-less.
Louise Napier
I can’t find how to find my Location Bar, I have two google search bars.
Sébastien Wains homepage » Firefox : always display the address bar
[...] Link : http://mozillalinks.org/wp/2007/03/keep-firefoxs-location-bar-on-sight/ [...]
Anthony Hazell
I cannot access the location bar so am unable to type in about: etc Please help!
mathieu
I’ve downloaded the latest version and the dom.disable_window_open_feature.location parameter is by default on “true”. Is this normal? cause im trying to remove it from a page on my website, thx.
another jon
That sucks. As a web designer I have good reason to want to hide this annoying URL. Why do the 99% of valid website creators always get screwed over because of the <1% troublemakers?
Juan FengMay 27th, 2009 at 9:47 pm
That’s why it’s an option. This way, people who don’t care that your website sucks are none the wiser anyway.
Jay
Can you please tell me how I can get my fire fox address back? The only thing I have is the google search bar and the Y search bar. But the main address bar that goes at the fire top I don’t have. I have been putting up with this for over a year and I am tired of it. I am needing help please. I have unistall fire fox and reinstall it. I still don’t have and address bar at the top.
Thank you!
jnez_nez@yahoo.com
Cameron
Have you got a webpage where I can test it out? It doesn’t seem to work on my bank’s website – http://national.com.au – then click “Go” in the top right hand corner which brings up a popup to log in to internet banking.
Reply
Aji JohnSeptember 2nd, 2008 at 12:43 am
open ur firfox and type about:config in ur location or addressbar. Change dom.disable_window_open_feature.location to false. now try to access ur page say http://national.com.au then click “Go” in the top right hand corner which brings up a popup to log in to internet banking. Now see the difference there is no location box in the popup window
Reply
Muriel FoxOctober 25th, 2008 at 7:04 pm
I tried this, and even restarted the computer. Still doesn’t work. How can I ensure that the location bar remains on the Firefox homepage in Vista? Thanks.
Reply