forbidBGRefresh delay until page focus annoying

[therube]

forbidBGRefresh delay until page (re)focus is annoying


I guess it's not the end of the world, but I find it annoying.

In most instances, I post & jump somewhere (usually to another thread), read, then jump back to review my prior post (to make sure it was correct).
So ... in most instances, I will always be waiting for the prior page to refresh.
Times past, the refresh was done while I was in the other tab, & all I had to do was review.
Now I have to wait.

[Giorgio Maone]

Simply put, there's no way I can think of to give you the protection against background refreshes and keep the annoyance aside.
You can use the nocript.forbidBGRefresh.exception preference, or disable the feature completely by setting noscript.forbidBGRefresh to 0, or suggest a better way to cope with this issue

[therube]

I'll give the exceptions whitelist a shot.

Heh.
While jumped back to a different tab, I can see the refresh going on in background tab.

[Giorgio Maone]

I actually have half an idea of skipping the background refresh checks for refreshes whose delay is 0 seconds and URL is different than current (i.e. poor man's HTTP redirections), because they're quite unlikely to be used in an attack (they would be too much in the open, since you're supposed to look at the tab you've just opened in a short timespan) and we don't stop redirections either.
This would take care of most "annoying" cases, e.g. the image hosting service you reported in a previous thread.

[dhouwn]

and URL is different.

What difference would it make? An attacker could just create a Meta-Refresh pointing to http://example.org/evil#[i]RandNum[/i] for each page refresh.

[Giorgio Maone]

and URL is different.

What difference would it make? An attacker could just create a Meta-Refresh pointing to http://example.org/evil#[i]RandNum[/i] for each page refresh.

The important criterion is not "URL is different" (which is just an optimization), but "delay = 0". BTW, same URL + delay = 0 is surely an annoyance which I can't see any legitimate use for.

On a side note, if you reinstall 1.9.9.84 this behavior and some other accuracy improvements, such as honoring the timing of the original refresh even after multiple blur/focus cycles, have been added.