Loading ...Keep Firefox’s location bar on sight
Published: March 9th, 2007
Some pop-up windows may hide the location bar for a number of valid good reasons like providing a less cluttered interface or a smaller window, but it is also an easy cover for malicious web sites to hide the real location of fake sites in cross site scripting (XSS) attacks.
Michal Zalewski, the hacker who uncovered a handful of security vulnerabilities in Firefox on last February, pointed it as one of Firefox’s weaknesses. Fortunately, as suggested in the bug discussion, this behavior can be changed to forbid the ability to hide the location bar to all web sites.
To do this:
- Enter about:config in the location bar
- Look for dom.disable_window_open_feature.location
- Double click it to toggle it to true
You are done. Now popups will show the location bar always. It may look weird at first but it’s a smal price to pay for additional protection.
You can leave a response, or trackback from your own site.
Subscribe RSS
Subscribe email
March 9th, 2007 at 11:20 am
Have you got a webpage where I can test it out? It doesn’t seem to work on my bank’s website - http://national.com.au - then click “Go” in the top right hand corner which brings up a popup to log in to internet banking.
[Reply]
Aji JohnSeptember 2nd, 2008 at 12:43 am
open ur firfox and type about:config in ur location or addressbar. Change dom.disable_window_open_feature.location to false. now try to access ur page say http://national.com.au then click “Go” in the top right hand corner which brings up a popup to log in to internet banking. Now see the difference there is no location box in the popup window
[Reply]
Muriel FoxOctober 25th, 2008 at 7:04 pm
I tried this, and even restarted the computer. Still doesn’t work. How can I ensure that the location bar remains on the Firefox homepage in Vista? Thanks.
[Reply]
March 9th, 2007 at 11:47 am
Cameron it works for me: http://www.mozillalinks.org/images/locbarblocktest.png
I didn’t need to restart, but guess it wouldn’t hurt you try.
[Reply]
March 9th, 2007 at 11:56 am
Ah, it seems that because I’ve moved the location bar to the menubar (alongside File, Edit, etc.) that I need to toggle dom.disable_window_open_feature.menubar too - thanks for the tip! :)
[Reply]
March 9th, 2007 at 12:07 pm
Additionally, could you add the following line to your css please?
img.wp-smiley {padding: 0px; margin: 0px;}
It’ll make smileys look far better ;)
[Reply]
March 9th, 2007 at 3:59 pm
Thanks Cameron! Will check it tonight.
[Reply]
April 6th, 2007 at 11:51 am
No http://www. address bar on Firefox……….WHY
[Reply]
April 10th, 2007 at 9:08 pm
This along with adblock is killer
[Reply]
May 17th, 2007 at 7:58 pm
Note: Havvy isn’t my last name.
Anyways, that function should be turned by default, no? I do know that Internet Explorer also lets that address bar being seen. So, a rare 1-UP over Mozilla from Microsoft.
Great find none-the-less.
[Reply]
June 13th, 2007 at 8:20 pm
I can’t find how to find my Location Bar, I have two google search bars.
[Reply]
December 22nd, 2007 at 4:16 pm
Why don’t I have a Mozilla Firefox address bar?
[Reply]
February 19th, 2008 at 9:50 am
I cannot access the location bar so am unable to type in about: etc Please help!
[Reply]
February 26th, 2008 at 1:33 pm
I’ve downloaded the latest version and the dom.disable_window_open_feature.location parameter is by default on “true”. Is this normal? cause im trying to remove it from a page on my website, thx.
[Reply]
March 23rd, 2008 at 7:10 pm
Thanks! I hate popups that do that!
[Reply]
September 25th, 2008 at 12:29 am
That sucks. As a web designer I have good reason to want to hide this annoying URL. Why do the 99% of valid website creators always get screwed over because of the <1% troublemakers?
[Reply]