I'm new to Tor. What is Application Boundaries Enforcer (ABE) and ClearClick and why should I have them turned on or off?



ABE and ClearClick are part of the NoScript add-on.


Clickjacking is a method of tricking you into clicking something you probably didn't want to click on. There's various ways to clickjack, but most of them use iFrames or JavaScript to partially cover a link or button, so you accidentally click on the "bad" link instead of what you thought you were clicking on.

ClearClick automatically detects clickjacking attempts, and shows you a warning. For exact details, read the FAQ here: https://noscript.net/faq#qa7_4


ABE is the Application Boundaries enforcer, and protects against cross-site request forgery, or CSRF. It basically blocks websites from accessing resources on your local network. More detailed information is available on Wikipedia: https://en.wikipedia.org/wiki/CSRF

Both of these features help keep you safer, so it's probably best to keep them turned on.

  • Thank you so much for your clear explanations and sources. I turned both of them on now. I'm curious though if I should also turn on the option to allow sites to push their own rulesets?
    – user15015
    Nov 12 '16 at 9:12
  • I can't find anything about it in the FAQ, so this is just my opinion now. I'd leave it disabled (default). It looks like it would only work if a website is set up for NoScript users, and a malicious website could misuse that ability. Most websites work just fine without special ABE rules anyway. Nov 12 '16 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.