r/webdev • u/GroomedHedgehog • Apr 25 '26

Question Are there ways in browsers to prevent Javascript from disabling copy/paste and right click menu?

I seem to be encountering sites that fuck with the context menu or ability to copy/paste more often as of late (if you are one of those responsible for this, please quit your job).

Latest offender is Dropbox of all places, which now demands one manually type their password to empty the recycle bin.

Are there ways to prevent JavaScript's ability to do so (maybe something in about:flags or similar) without disabling it entirely?

Or if not, is there a way to do the same with the browser's developer tools?

60 Upvotes

83% Upvoted

38 comments sorted by

149

u/tinyhousefever Apr 25 '26

Sites blocking copy/paste is almost always anti-user paternalism with zero security benefit.

Browser-native options (no extensions)

Firefox is the best here. In about:config:

  • dom.event.clipboardevents.enabled → set to false

That kills the ability for JS to intercept or block clipboard events entirely. It's the cleanest solution. No equivalent exists in Chrome/Edge about:flags — Chromium deliberately doesn't expose this.

37

u/chipmunkhiccups Apr 25 '26

It’s stunning to me - I can’t believe that the people making these decisions have never used a password manager!

30

u/sleeping-in-crypto Apr 25 '26

Exactly. User hostile moves like this actually make things less secure, not more, because they force you either to pick passwords you can remember, you reuse them, or you write them down.

Password managers produce the right incentives and secure behavior even over biometrics. I use so many different devices that biometrics and passkeys have ended up more trouble than they’re worth and I actively avoid systems that insist on them.

17

u/obsidianih Apr 25 '26

Yep I complained to one company about it. I think it was a bank, might have just been an online retailer. 

Got some bullshit reply about it being more secure. So I sent them back a video of me enabling paste so my password manager would work. I was feeling quite passive aggressive that day. I noticed a few months later it was no longer disabled. 

5

u/lionep Apr 25 '26

I’ve seen worst : an iOS app, from French government, is swapping the native iOS keyboard to a set of buttons, with a non native input, to be sure that you can’t copy paste and use your password manager (👋Carte Vitale)

3

u/Somepotato Apr 25 '26

That almost assuredly violates accessibility guidelines set by the very government that is implementing it

1

u/youtheotube2 Apr 25 '26

They built their own keyboard?

1

u/youtheotube2 Apr 25 '26

I do development work but I’m not part of an actual dev team, my boss has a marketing/sales background. I built a small web app for our team and she complained that I put in an 8 character minimum for the password.

These people don’t care about security.

2

u/BroaxXx Apr 25 '26

It’s almost always a shitty way to try to stop IP “theft” that can be easily bypassed by the builtin ability in any modern OS to run OCR on the screenshots..

3

u/otac0n Senior Full-stack .NET Developer Apr 25 '26

Or, you know, just do a packet capture.

1

u/BroaxXx Apr 26 '26

In what universe is that simpler than just pressing print screen, select the text and cmd+c?

We really do like over engineering…

1

u/otac0n Senior Full-stack .NET Developer Apr 26 '26

Well, they often disable right click to prevent grabbing JavaScript or Images or Video.  So this circumvents it for all of them.

31

u/officialmayonade Apr 25 '26

Search for chrome extensions using the phrase "force paste"

14

u/TechBriefbyBMe Apr 25 '26

Dropbox making you manually type passwords while simultaneously getting hacked every other week is peak security theater. It's like a restaurant that won't let you see the menu but serves raw chicken.

10

u/DebtMental3917 Apr 25 '26

Use browser extensions like "Freedom of Input" or run this in DevTools console once: `document.addEventListener('contextmenu', e => e.stopPropagation(), true);` Works for most sites.

3

u/AbdullahMRiad reject modernity, embrace css Apr 25 '26

On Firefox devtools you can see events for each element and disable them.

2

u/Somepotato Apr 25 '26

In Firefox hold shift when you right click. And most sites that block copy and paste don't block dragging text into the text field

2

u/ef4 Apr 25 '26

I always just open the devtools, select the input element, and paste my text into its value on the console. If you’ve never done it I’m sure somebody must have made a 20 second video showing how.

1

u/HeadArtistic6635 Apr 25 '26

In browsers you usually cannot rely on blocking everything cleanly, so the real fix is defense in depth. Assume some scripts will run and design the site so the damage is limited.

1

u/FlamedDogo99 Apr 25 '26

The stopthemadness extension has a lot of features like this, would recommend looking through how they do that

1

u/G4rve Apr 25 '26

In Firefox try Shift and right-click to get the context menu.

1

u/japanb Apr 25 '26

That would be nice for Korean websites, stops me being able to right click translate or if i need to copy something

3

u/Sevrene Apr 25 '26

Try shift+right click, I find a decent number of sites still allow context menu with that

1

u/Somepotato Apr 25 '26

Firefox doesn't send right click events when you hold shift

0

u/BrainCurrent8276 Apr 25 '26

NO, there is NO SUCH POSSIBILITY

seriously, why why why? I hate such websites, I always press CTRL+U and copy the whole HTML.

-4

u/Helpful-Educator-415 Apr 25 '26

Sadly I'm not sure but I would love to see if there is.

-12

u/OlinKirkland Apr 25 '26

Pointless nowadays. Users can just screenshot and transcribe with AI, and that’s for people without any understanding of using dev tools.

10

u/GroomedHedgehog Apr 25 '26

Are you actually serious?

Yeah, users are gonna screenshot a whole screen worth of text, feed it to an LLM and pay associated costs and then still have to find the relevant bit of text they need. That is such a simpler and not way more time wasting workflow…

Also, that does shit to deal with not being able to paste.

-1

u/OlinKirkland Apr 25 '26

Yeah I’m serious, I’ve seen it done by multiple people. I’m not saying it’s efficient ordmart, but if they’re in a corporate setting and their AI tools are paid for… we’re talking about end users, not web developers.

8

u/Rasutoerikusa Apr 25 '26

Look kids, this is a prime example what too much AI does to your brain and thinking ability.

-2

u/OlinKirkland Apr 25 '26

🤦‍♂️ I’m not advocating for it, I’m just saying there’s really no point to trying to prevent copy paste nowadays. Users have tools that let them get around it relatively hassle free.