{"id":43841,"date":"2024-06-24T15:53:45","date_gmt":"2024-06-24T19:53:45","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=43841"},"modified":"2024-06-24T15:53:45","modified_gmt":"2024-06-24T19:53:45","slug":"always-allow-safari-bookmarklets","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2024\/06\/24\/always-allow-safari-bookmarklets\/","title":{"rendered":"Always Allow Safari Bookmarklets"},"content":{"rendered":"

Jeff Johnson<\/a>:<\/p>\n

You may already be aware that for a number of years, Safari has asked your permission every time you click on a link, such as an RSS feed, that opens in an app other than Safari[…]<\/p>

[…]<\/p>

The permission prompt now has an option to “Always Allow”! This option is new in Safari 17.<\/p><\/blockquote>\n

This is an improvement, but even with Always Allow<\/strong> it only remembers per-domain<\/a>. So I’m still prompted a lot when using MarsEdit<\/a> and EagleFiler<\/a> bookmarklets. And it messes up my muscle memory because I had been in the habit of always pressing Enter after invoking a bookmarklet to Allow<\/strong> it—Can you see from the slightly bold text in this iOS-style alert that Allow<\/strong> is the default button?—but with Always Allow<\/strong> it’s unpredictable. I have to either pause to see whether I need to press Enter or I end up with an extra blank line in my blog post draft.<\/p>\n

\n

You might wonder where this new preference is stored on disk. As far as I can tell, there’s no corresponding user interface in Safari Settings, certainly not in the Websites pane. What if you want to undo your selection? What if you select Always Allow by accident?<\/p>\n

[…]<\/p>\n

The good news is that with a little reverse engineering, I found a way to undo the preference. It’s stored on disk in the file ~\/Library\/Safari\/PerSitePreferences.db<\/code>, which is an SQLite<\/a> database.<\/p>\n<\/blockquote>\n\n

Jeff Johnson<\/a> (Mastodon<\/a>):<\/p>\n

To run bookmarklets in Safari on macOS, you need to enable “Show features for web developers” in Safari Advanced Settings and “Allow JavaScript from Smart Search field” in Safari Developer Settings.<\/p><\/blockquote>\n

I think this is only necessary for testing them. I have this unchecked, and my previously created bookmarklets still work.<\/p>\n

\n

The permission is per-website, which means that every time you use the EagleFiler bookmarklet on a different website, Safari requests your permission again<\/em>!<\/p><\/blockquote>\n

But he has a workaround:<\/p>\n

\n

This JavaScript first calls window.open()<\/a>, which creates a new about:blank<\/code> tab. It then creates an HTML anchor<\/a> element—in other words, a hyperlink—adds the link to the about:blank<\/code> document, and clicks the link automatically.<\/p>\n

[…]<\/p>\n

This time the value of the domain is empty (''<\/code>), because about:blank<\/code> has no domain. The about:blank<\/code> trick allows you to use the same bookmarklet on every website without any additional permission prompts!<\/p><\/blockquote>\n

This kind of exposes the permission prompt as security theater, but if it’s not protecting us anyway we may as well get rid of the annoyance.<\/p>\n\n

Previously:<\/p>\n