Is graceful degradation in the absence of JavaScri

Question

When even mobile browsers have JavaScript, is it really necessary to consider potential script-free users?

Answer 1

I for one always have NoScript turned on unless I trust the site for a number of reasons including cross-site-scripting, click jacking, and HTML injection. It's not me being paranoid, it's because I know a lot of developers, and know most of them have no idea what web security is, never mind how to avoid vulnerabilities.

So until I trust a site there's no chance I'd let it do anything fancy.

For the unfamiliar, there are some interesting blog entries on the subject:

• Protecting Your Cookies: HttpOnly
• Cross-Site Request Forgeries and You
• Sins of Software Security
• Top 25 Most Dangerous Programming Mistakes

Answer 2

It's generally much faster to browse with Javascript disabled (digg.com is lightning without JS), which is why it's popular.

In Opera it's really easy: you simply press F12 and untick the javascript option. I always browse without Flash, Java (not javascript), animated images and sound. I enable Flash on a per-site basis, eg YouTube. Sometimes I turn off JS temporarily if my system is slowing down.

And don't forget about:

• Screen readers (I think they mostly have JS disabled)
• Text browsers or other very old systems
• Ad blockers (if your filename happens lands under their radar)
• Any old browser that either doesn't support JS at all or the JS breaks (e.g. IE6 doesn't support some modern JS stuff).

The solution is to use progressive enhancement rather than graceful degradation, i.e. start with the basic HTML and add CSS. Then add Javascript and/or AJAX to parts of the site.

For example, if you had a site like Stack Overflow, voting up an answer could submit a form normally. If JS is enabled, it would do an AJAX request, update the vote count and cancel the form submission, without leaving the page. SO doesn't do this though...