Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to tweak Safari to ensure command key combinations like H or L go to Safari as opposed to Safari's window contents?

This comes up for me most often on this site because the editor window (like where I'm typing right now) captures these keystrokes to make headings and links, but in general, it seems like a security hole to allow sites to capture command keystrokes.

Please note that I'm looking for a way to do this without disabling JavaScript altogether.

For whatever it's worth, I'm running Mountain Lion.

share|improve this question
You can use NinjaKit to disable the shortcuts used on Stack Exchange sites. See and – user495470 Jul 1 '13 at 14:09
That's awesome, @LauriRanta, and it helps with this specific problem, but as a general security hole, I'd love for a way to prevent malicious websites from trapping ⌘W or ⌘Q without simply disabling JavaScript. – Daniel Jul 1 '13 at 17:02
I added the security tag. Because to know which part of an application is reading (listening to) the keyboard is a basic security feature. If any keyboard listener change was displayed by the menu bar, many attacks based on sniffers would do as coackroaches when you turn on the light. – daniel Azuelos Jul 15 '13 at 14:51
@DanielLawson Would this open source Safari extension help – Simon Aug 27 '13 at 20:12
up vote 2 down vote accepted

The only surefire way to avoid having JavaScript trap keyboard input is to disable JavaScript in the browser.

I understand you'd like to leave JavaScript on, but it is designed to pass near total control of raw key presses to the browser and not to the app once the OS hands it input data. This means you would need a specific code solution for each implementation of keyboard filtering on potentially each individual page/site to ensure arbitrary key chords like Command H get sent to Safari instead of JavaScript.

See these links for an overview of how key presses are handled:

The last link is a tester to show you the raw events and you will see that even a brief ⌘Q can be trapped by JavaScript if the website developer wishes to do so.

share|improve this answer
The keyboard driver is part of the OS, so the OS passes the keystrokes to the browser, which passes the keystrokes to web content, which apparently then gets to decide which keystrokes to pass back to the browser and/or OS… – Daniel Aug 26 '13 at 20:07
It's probably even more complicated than that with kernel space / user space / API and framework complexities. – bmike Aug 27 '13 at 14:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.