What a JavaScript browser check is

A JavaScript browser check is code that runs on the client and looks at the page environment, not only at the request headers. In Metrica, the absence of JavaScript is covered by a separate rule in the “Robots” report, and it does not collapse to the phrase “no script means a robot.” These pages do not declare click fraud from the single fact that JavaScript did not run.

The “Robots” report has a rule “Filtered for lack of JS and Referer”: the visit had no JavaScript and no Referer on the image in noscript. The help unpacks it this way. The counter code consists of JavaScript and an invisible image in noscript. If JavaScript is off or not supported, view data leaves in the Referer header when that image loads. If the header did not arrive, Metrica treats the view as robotic. That is one named rule of the report. The same page still does not decode the behavioral rules.

No JavaScript on its own is not enough for this rule: the Referer of the image in noscript is looked at as well. The view becomes robotic when neither the script nor that header was there.

Active collection runs as code; passive collection comes from the request

A W3C note splits collection into passive and active. Passive collection reads what is already on the request, with no code on the client: a cookie, the set of HTTP headers, the address, and other network data. User-Agent is given as an example of a passive channel: it usually names the browser, the engine, the version, and the operating system. Active collection runs JavaScript or other code on the client. The note says CSS techniques are already catching up with JavaScript. Examples of active collection include window size, enumerating fonts and connected devices, a performance measurement, sensors, and rendered patterns.

Active collection is in principle visible on the client. Traits more often leave for the server in a batch, and the server combines them out of the page’s sight. The list illustrates classes. It is not the list of fields a visit decision is made on. A JavaScript check belongs to the active class: the code runs on the client. A passive header does not replace it and is not itself the list of decision fields.

Headless does not cancel that. The Headless flags help distinguishes --dump-dom from downloading HTML the way curl does. To print the DOM, Chrome first parses the HTML, runs scripts that may change it, and only then serializes the result. That is a description of a standard flag, not a list of signs by which a visit is treated as automatic. A client that runs the page’s scripts is already not the same as fetching the source. Running JavaScript therefore does not prove a person is behind the page: headless also runs scripts before it returns the DOM.

A task in the browser is not a ban on visits without a script

An OWASP note describes a technique in which the client is given a cryptographic or proof-of-work task, to stretch the time of an attack. The technique does not require a person in the loop and limits the rate of a particular client implementation. OWASP separately warns that banning visits without JavaScript hurts accessibility, including for screen readers. That is a description of login protection, not the parameters of a Binetro task. The product’s task parameters are not published here.

A ban of “no JavaScript, do not admit” and a computational task are different techniques. OWASP ties the first to a loss of accessibility. The second does not require a person in the loop and hits the rate of a particular client implementation. Metrica’s rule about missing JS and Referer is a third: it marks a view robotic in the report when neither the script nor the image Referer arrived, and it does not set Binetro’s task parameters.

A visit decision is built from several independent observations: behavior on the page, the browser environment, the network and address, request frequency, and the parameters of the ad click. One observation does not know the rules of the others. The field set, the scores, and the rules of individual checks are not published. What JavaScript saw in the window or in the fonts is one observation. It does not know what the network, the frequency, and the click parameters decided.

An invalid click is not equal to the row “no JavaScript” in the robots report. Whether Yandex returns the money is not promised by this rule. Who clicks without a purchase is in the article on who clicks ads. The difference in terms is in the article on click fraud and sklikivanie.

A JavaScript check looks at the environment on the client and is in principle visible there. In Metrica a view is treated as robotic when both the script and the Referer of the image in noscript are missing. Headless running scripts does not make the visit human. One observation does not issue the decision.