I have a script file that I want third party implementors to include in their web pages.
I want this script to be the first tag included in the body, so
<body>
<script type="text/javascript" src="/my_script.js"></script>
...
What's the best way to go about doing this without using any third party libraries?
My intent is that this script gets run before any of the page is rendered. If the tag isn't included correctly, I want to display an error message to the developer, telling them to put the tag as the first tag in the body.
EDIT: This script is going to be used to protect against clickjacking, and will basically hide the entire document if the embedder isn't in a whitelist. Why does it need to be the first script in the page? To ensure that nothing clickable becomes visible before the script is run, and to ensure that other script errors don't interfere with this being run as well. So it doesn't absolutely need to be first, but it should be super close to first ;-) This approach is based off of this suggestions at the Owasp site, but is trying to be a more of a "just drop it in" solution.
In /my_script.js. You can add this code:
if (document.body.firstElementChild == document.currentScript) {
// Is first element
} else {
// Is not first element
}
I'm not sure why you'd need to do that but here's how to do that.
If you want to move the script:
document.body.insertBefore(document.currentScript, document.body.firstChid);
document.currentScript.parentElement.removeChild(document.currentScript);
if (( document.scripts || document.getElementById('script') )[0] == document.currentScript)
Collected from the Internet
Please contact [email protected] to delete if infringement.
Comments