1

A little bit of background, we've made an electronic POS system for registered vendors of items of a well known brand. The vendors are required to login to use the system.

Recently, IE has been giving us lots of painful maintenance problems than before. Our boss is getting worried about running into further maintenance problems, so he has asked me to find out a way to automatically install & launch chrome if they try to login with any other browsers (For the record, nearly all of the issues are related to some feature working fine on FF/Chrome/Opera/Safari but doesn't on IE).

Let us put aside the ridiculousness of running an external .exe from Javascript, which is practically impossible (And rightfully, I told him so. But he insisted it was possible, so whatever).

So my questions are:

  • Is this request technically viable? Is there a guaranteed way to block requests from all browsers except for allowed ones?
  • Is this request reasonable? IMO, From the standpoint of users, limiting accessibility does more harm than good, but maintenance issue is definitely a valid business concern.
  • Has there ever been a case like this where other websites explicitly blocked certain browsers?

Edit: Thanks for the answers. We're supporting IE 7+ at the moment and indeed, 7/8 were the ones that caused most of the grief. Just dropping those two will make maintenance significantly easier but my boss thinks the problem has to do with IE itself, not necessarily the versions. I'm going to try to see if I can convince him, but I have a strong feeling he's going to stick by what he thinks.

  • 1
    There is no way to force a user into installing Chrome (or whatever) via browser. You can detect the browser type of course and recommend to switch (provide link). How viable this is would depend on the kind of service you provide and the kind of maintenance issues you have. You could block a certain browser (though there would be rather simple ways to get around this if the user has some knowledge). – thorsten müller Sep 9 '13 at 14:30
  • 13
    I think this is a case of using a popular opinion about the dislike of IE to avoid the fact that the web developer didn't do a good job. – Reactgular Sep 9 '13 at 16:12
  • 1
    Just an indirect answer - it's become pretty common to deny users of browsers like IE6 entry, but you might want to check if any higher versions actually still work okay. To circumvent any existing UA-detecting code, you could give IE9/IE10 another user agent, and see how much of the site works. Then, drop compatibility for lower versions. – Katana314 Sep 9 '13 at 16:53
  • 12
    I can see blocking IE6 perhaps, but if you can't get a site working in IE9+, you're doing something wrong. – GrandmasterB Sep 9 '13 at 17:14
  • 5
    IE's default behavior is to launch Intranet sites in "compatibility mode". Check if that option is turned on. – user16764 Sep 9 '13 at 17:46
11

Is this request technically viable?

No, not least because technical users will be able to spoof the requests - that said those users that are capable or walking round the limitations are more likely to be using a browser that doesn't cause you problems.

Is this request reasonable?

Maybe - but I refer to my earlier answer, the users that can easily change their browsers are unlikely to be the ones that are having problems.

Has there ever been a case like this where other websites explicitly blocked certain browsers?

Sadly yes, still persists and is very irritating (once it was genuinely about supported capabilities but from IE9 that's marginal). Call me peverse but I like IE - I've been using it since it was in beta (at which point it was refreshingly better than netscape) - but equally I use IE9/10/11 and here is where things get fun.

Firstly you need to be clear about what specific version of IE are causing you grief - and why. If its 6 and 7 then yes, you need to encourage your users to use something better because its not reasonable to have to support them. 9 or better - then there's a case to argue that the problems need to be resolved in your (by replacing browser sniffing with capability detection and appropriate polyfills) 8... 8 is the nasty edge case. IE 11 doesn't even report itself as IE any more to try and stop sites that have no reason not to work deciding that they don't want to play.

Hmm end rant.

The simple answer is to define versions of IE that you don't support and to explain why and to then express that clearly to your users - but you ought to support at least 9 or better...

  • +1 - IE has some very special features in the corporate/epos space like kiosk mode and fine grained controls via group policy (or the IEAK) which others have via plugins if they work, but I've found them easy to circumvent (FF I'm looking at you!) – James Snell Sep 9 '13 at 19:37
  • Also you may need to support IE8 too as it's the latest version that works on Windows XP, at least until MS stop supporting XP anyway. – James Snell Sep 9 '13 at 19:42
  • 1
    Which would be now. – Alan B Jun 22 '15 at 15:38
4

While support ends in Jan. 2014, I'd still consider Google Chrome Frame to be the best solution to this problem. It's not "installing and launching Chrome", but its about as close as you can get while still being secure.

http://www.google.com/chromeframe

It basically runs Chrome inside of IE, doesn't need system administrator access, and can be triggered to install (via a prompt) on page load.

Another alternative would be to bundle your application in a single-site browser, using something like TideSDK or Node-Webkit.

Then you could make your POS work as a desktop app on some platforms, and limit the environments you spend time supporting.

  • When I'm doing sysadmin work one of the first things I do is block chrome frame. Code that attempts to execute from within a user space/folder should be treated as a virus. – James Snell Sep 9 '13 at 18:57
  • @james-snell Isn't the whole point of separating user space/folders from kernel/system/administrator space/folders so that users can run what they want, and the impact to the system will be minimal, or last only as long as the user account is active? (obviously not everything, but best security practices should be observed) – t3rminus Sep 9 '13 at 19:02
  • 1
    Best practice in security is to block code execution from the user folders to mitigate potential privilege escalation vulnerabilities. Also PCI-DSS mandates very strict change control and versioning procedures which letting users just install what they like definitely wouldn't pass. – James Snell Sep 9 '13 at 19:33
3

I've seen browser detection code that tries to access various Things in javascript/the DOM and catch failures. Based on the particular failures caught, the code then sets global variables indicating what kind of browser is in use, and then decisions can be made.

Instead of force-installing chrome, you could try telling clients to enable compatibility mode in IE, with clear directions on how to do that. Or maybe (better) put the right doctype attribute on the HTML tag itself, which should automatically cause IE to enter the right mode. Do a little research on IE and doctype attributes. (Not being snarky, I'm just too rushed at the moment to do it myself, although I have in the past.)

Wait, here ya go:

http://msdn.microsoft.com/library/cc288325(v=vs.85).aspx http://www.w3schools.com/tags/tag_doctype.asp

and here:

http://www.quirksmode.org/js/support.html

(Research is fun!)

3

Forcing an install is not possible. You can block them & strongly recommend that they install a new browser but you can't force them to do anything - doing so would be a massive security hole waiting to happen.

More importantly, if you're writing business software, why the hell aren't you targeting IE? Chrome & Firefox have great market penetration on consumer systems but business systems are still primarily IE and, in many cases, the user can't install a new browser even if they want to - they flat-out do not have permissions to do so.

1

The standard way to identify the client browser being used is the USER AGENT string. However, web browsers are known to lie, and a general principle of server implementation should be that you never trust the client with anything. EVER.

So in answer to point one, can you be 100% sure what client browser is being used? No. But you can make educated guesses, and validate those guesses by passing javascript to the client to test those guesses.

In point two. As a user, if a website ran a different program on my machine with no warning I would be extremely unhappy. Redirecting the web browser to a page stating that the website was not compatible with IE, and suggesting that I point chrome / firefox would raise an eyebrow, but would be just about acceptable to me as a user.

In point 3, Yes there have been, and still are cases where websites and web applications are not compatible with certain web browsers. perhaps 10 years ago, it was common for banking websites to block clients with FireFox User agent strings, so I used to get firefox to send in Explorer UA strings for that site. More recently, new releases of Explorer tend not to work on a wide range of sites. (hence compatibility mode in IE to allow it to work whilst everyone updates their websites).

The problem historically has been because Microsoft has been fairly poor at implementing standards. Every attempt by microsoft to move closer to the standards breaks the web experience, because the websites present pages designed for the broken old browser. These days, issues tend to be more to do with the JavaScript api for the bowers varying.

  • 1. "Don't trust the client" is more a matter of security than usability. You can assume a hacker will just use a telnet client directly, but his question is focused on Mr. Dumbuser being able to use the site as they expect on whatever browser they have (and won't likely have a user-agent switcher on). 2. We all know the history of MS failing at all the standards; the good news is that in some very recent browsers they've somewhat reversed that policy and played nice; hence my comment above that you should consider treating IE9 or IE10 the same as Chrome/FF. – Katana314 Sep 9 '13 at 17:42
0

If I, as an end user, use a widely used browser without employing any clever tricks, then you can detect which browser I am using, and your server code can easily block my browser (display a website saying "please use a different browser").

If I detect that your website doesn't support my browser, and I want to use your website and not change my browser, then it is likely that I as an end user, or someone more clever than me, can set up my browser so that it gets past your code. If let's say IE version 7 pretending to be Safari for iOS doesn't work, I'd say I have only myself to blame; other users might be less reasonable. Trying to block out people using unsupported browsers while pretending to be different browsers is pointless IMO.

Later versions of Internet Explorer have much better compatibility with other browsers, and are widely used. If your boss decides to exclude all versions of Internet Explorer, I could imagine that he will get some serious complaints from customers. That's his or her problem (unless it's so bad that your salary cannot be paid anymore).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.