Javascript doesn't work, even with sites on white list

[Lucio]

Hi, I have this problem since a couple of months
I always update all software to last stable version, and with a site on white list plus temporarily allowed, javascript is always disabled.
Can you help me?

[Giorgio Maone]

Can you show us the site in question?
Did you try NoScript Options|Reset, then re-giving the permissions?

[Lucio]

Can you show us the site in question?
Did you try NoScript Options|Reset, then re-giving the permissions?

It works!!!
It was on every site, but now that I have all option by default it works, thank you.
Now can I ask what option could make that? I followed on a forum I trust the instruction of how customize it, to be best pretected... I thought it would be safer!
Here is my config, I would deselect only the option that make this issue , so if anyone could watch it, thank you.
http://www.mediafire.com/?dyihiyooimj

[Lucio]

I have made a list of difference between default and my option:
in the default:

Code: Select all

"showRecentlyBlocked":true,
"showRevokeTemp":true,
"forbidXBL":4,
"autoReload.allTabs":true,
"policynames":"",
"secureCookies":false,
"injectionCheck":2,
"showTempToPerm":true,
"showAllowPage":true,
"blockNSWB":false,
"allowHttpsOnly":0,
"forbidMetaRefresh":false,
"forbidIFrames":false,
"firstRunRedirection":true,
"showGlobal":true,
"xss.trustTemp":true,
"forbidBookmarklets":false,
"forbidFrames":false,

and in my config:

Code: Select all

"showRecentlyBlocked":false,
"showRevokeTemp":false,
"forbidXBL":5,
"autoReload.allTabs":false,
"policynames":"previewSites",
"secureCookies":true,
"injectionCheck":3,
"showTempToPerm":false,
"showAllowPage":false,
"blockNSWB":true,
"allowHttpsOnly":2,
"forbidMetaRefresh":true,
"forbidIFrames":true,
"firstRunRedirection":false,
"showGlobal":false,
"xss.trustTemp":false,
"forbidBookmarklets":true,
"forbidFrames":true,

plus here there were also: "httpsForcedExceptions":"",
If i knew which of these voices are in the GUI of the addon, I could make it myself...
I hope you can help me.

[Giorgio Maone]

Most likely "allowHttpsOnly", which means only HTTPS web site matching your whitelist are allowed.
Keep it 0, or 1 at most, unless you don't trust your network connection at all.

[Lucio]

Most likely "allowHttpsOnly", which means only HTTPS web site matching your whitelist are allowed.
Keep it 0, or 1 at most, unless you don't trust your network connection at all.

Thank you very much, now I can finally use NoScript!!

[Elvey]

NOTE: The spam filter is being triggered by "allow...Https...Only", so I added the "..." so that it wouldn't be triggered. (speaking of binary search!)

Most likely "allow...Https...Only", which means only HTTPS web site matching your whitelist are allowed.
Keep it 0, or 1 at most, unless you don't trust your network connection at all.

One of my Firefox profiles' NoScript wasn't working - all javascript was blocked even though Javascript was enabled in the browser and the site was in my NoScript whitelist. I finally traced it to having set allow...Https...Only. What was I thinking? Maybe I was on a particularly untrustworthy Wi-Fi network (e.g. at an airport or convention center)? I don't recall, as it was many months ago.

I couldn't figure out why at first. Eventually, I found my configuration mistake by doing a binary search - using ediff, merging half the suspect changes (in setting exports) between my config and a reset config: 22 -> 11 -> 6 -> 3 -> 2 -> 1.
I wonder if settings like forbidMetaRefresh, which Lucio has set to true, often break things in a similar hard to figure out what's wrong way, and if NoScript could be more helpful in indicating what's going on. For example, even if allow...Https...Only is set, the UI makes it look like one can 'allow all from' a site that won't be allowed unless allow...Https...Only is unset (set to 0). But, changing that wouldn't make it easier to figure out what was wrong. Is there an error log/debug mode? There's no "Tools|Error Console" now. None is mentioned here: http://forums.informaction.com/viewtopic.php?f=7&t=1431

[Thrawn]

The 'active content only via https' feature is an interesting one, and it has merit, because any HTTP traffic could theoretically be intercepted, so you can't be completely sure that the script you're running is really from the site you whitelisted. With no encryption, any router that handles the traffic could inject extra page content (and ISPs have been known to do this, injecting advertising etc). However, I find it unusable, because there are so many sites that don't use HTTPS.

The alternative that I choose is to configure NoScript (under Options - Appearance) to show full addresses - protocol, domain, and port - so that I can choose to trust only the HTTPS site if it is available, or the HTTP site if I must. That way, I still allow active content only over HTTPS as much as is feasible.