Security Vulnerabilities Guide

Understanding and fixing common web security vulnerabilities detected by VitaPulse

Medium

Geolocation Permission on Page Load

Your site requests geolocation permission immediately when the page loads, before any user interaction.

Risk

Requesting sensitive permissions without user context is a poor practice that erodes trust. Users are more likely to deny the permission and may leave your site. Browsers may automatically block repeated permission requests, making the feature permanently unavailable. It also signals poor UX design to search engines.

Solution

Only request geolocation permission in response to a user action (button click, form interaction). Explain why you need the location before asking. Provide a fallback for users who decline.

Example

// Good: Request after user action
button.addEventListener('click', () => {
  navigator.geolocation.getCurrentPosition(callback);
});

Permission UX - web.dev

Comments (0)

No messages yet.