javascriptsecurityservice-workerpage-refreshtrust

Prevent website change, ever


For security reasons I need to make it so that, once a website is loaded in a browser, that website cannot be updated at all, even with a manual refresh. Is this possible with Service Workers and/or some other technology, and if so, how?


Solution

  • If this were possible, any attacker could temporarily hijack a website, and do permanent damage (typically defacement). The security considerations of HTML5 offline web application standard discuss this in detail.

    Therefore, it is not possible to prevent a website from being updated by its owner or the user.