47

I am using a mobile network based internet connection and the source code is being rewritten when they present the site to the end user.

In the localhost my website looks fine, but when I browse the site from the remote server via the mobile network connection the site looks bad.

Checking the source code I found a piece of JavaScript code is being injected to my pages which is disabling the some CSS that makes site look bad.

I don't want image compression or bandwidth compression instead of my well-designed CSS.

How can I prevent or stop the mobile network provider (Vodafone in this case) from proxy injecting their JavaScript into my source code?

3
  • Is this a free hosting or this is your own paid hosting? Nov 6, 2010 at 13:35
  • This is a paid connection and hosting is not free Nov 6, 2010 at 14:33
  • +1 The same issue with me. Using Vodafone 3g in India.
    – shashwat
    Oct 12, 2014 at 7:51

13 Answers 13

45

You can use this on your pages. It still compresses and put everything inline but it wont break scripts like jquery because it will escape everything based on W3C Standards

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

On your server you can set the cahce control

"Cache-Control: no-transform"

This will stop ALL modifications and present your site as it is!

Reference docs here

http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.5

http://stuartroebuck.blogspot.com/2010/08/official-way-to-bypassing-data.html

Web site exhibits JavaScript error on iPad / iPhone under 3G but not under WiFi

7
  • 1
    This actually helped me a lot. For the record, Vodafone Romania also employs this strategy for "optimizing" their mobile web traffic.
    – AlexB
    Jan 22, 2012 at 20:11
  • Caveat emptor: it will only stop all modifications iff intermediate proxies respect your Cache-Control header. They may as well have chosen to ignore it.
    – Confusion
    Jan 25, 2012 at 11:52
  • 2
    @Confusion True, but as it turns out most of mobile internet providers use the same platform for ”optimizing” web traffic and this platform does support the no-transform directive.
    – AlexB
    Jan 28, 2012 at 22:20
  • 1
    Cache-Control: no-transform solved it for me using a ISP running on the Vodafone Germany network. This thing they do is plain evil.
    – Mahn
    Nov 11, 2013 at 17:00
  • 1
    Thanks very much for this, we had the same problem on my Apex web site. Client was using Firefox on Vodaphone 3G, no problem when they switched to their ADSL connection. Since I'm using Apache I fixed it by adding Header merge Cache-Control no-transform to my config. Mar 7, 2014 at 3:37
35

You're certainly not the first. Unfortunately many wireless ISPs have been using this crass and unwelcome approach to compression. It comes from Bytemobile.

What it does is to have a proxy recompress all images you fetch smaller by default (making image quality significantly worse). Then it crudely injects a script into your document that adds an option to load the proper image for each recompressed image. Unfortunately, since the script is a horribly-written 1990s-style JS, it craps all over your namespace, hijacks your event handlers and stands a high chance of messing up your own scripts.

I don't know of a way to stop the injection itself, short of using HTTPS. But what you could do is detect or sabotage the script. For example, if you add a script near the end of the document (between the 1.2.3.4 script inclusion and the inline script trigger) to neuter the onload hook it uses:

<script type="text/javascript">
    bmi_SafeAddOnload= function() {};
</script>

then the script wouldn't run, so your events and DOM would be left alone. On the other hand the initial script would still have littered your namespace with junk, and any markup problems it causes will still be there. Also, the user will be stuck with the recompressed images, unable to get the originals.

You could try just letting the user know:

<script type="text/javascript">
    if ('bmi_SafeAddOnload' in window) {
        var el= document.createElement('div');
        el.style.border= 'dashed red 2px';
        el.appendChild(document.createTextNode(
            'Warning. Your wireless ISP is using an image recompression system '+
            'that will make pictures look worse and which may stop this site '+
            'from working. There may be a way for you to disable this feature. '+
            'Please see your internet provider account settings, or try '+
            'using the HTTPS version of this site.'
        ));
        document.body.insertBefore(el, document.body.firstChild);
    }
</script>
1
  • 2
    Likely yes, but only if such access is allowed out of the network at all. Another workaround, I guess, would be to return a media type other than text/html. For browsers that support application/xhtml+xml that would be a possibility, if you can produce markup that meets the more rigid requirements.
    – bobince
    Nov 10, 2010 at 20:34
16

I'm suprised no one has put this as answer yet. The real solution is:

USE HTTPS!

This is the only way to stop ISPs (or anyone else) from inspecting all your traffic, snooping on your visitors, and modifying your website in flight.

With the advent of Let's Encrypt, getting a certificate is now free and easy. There's really no reason not to use HTTPS in this day and age.

You should also use a combination of redirects and HSTS to keep all of your users on HTTPS.

1
  • 2
    We should all be using HTTPS, this is the most relevant answer - no need to use 'no-transform'. Thanks.
    – Null
    Jun 23, 2018 at 13:21
8

You provider might have enabled a Bytemobile Unison feature called "clientless personalization". Try accessing the fixed URL http://1.2.3.50/ups/ - if it's configured, you will end up on a page which will offer you to disable all feature you don't like. Including Javascript injection.

Good luck! Alex.

3
  • it begs to wonder how can the ISP get away with not telling us about this , thanks for the 1.2.3.50/ups info, it works.
    – valexa
    Dec 11, 2013 at 0:41
  • @valexa Possibly your ISP doesn't know about this and it's left in the default configuration. Dec 13, 2013 at 12:10
  • +1 for the admin console link ;) - With default ISP settings, fontello.com is useless (not working at all), now, everything is disabled and is working !
    – qdev
    May 9, 2015 at 12:32
7

If you're writing you own websites, adding a header worked for me:

PHP:
    Header("Cache-Control: no-transform");
C#:
    Response.Cache.SetNoTransforms();
VB.Net:
    Response.Cache.SetNoTransforms()

Be sure to use it before any data has been sent to the browser.

6

I found a trick. Just add:

<!--<![-->

After:

<html>

More information (in German):

http://www.programmierer-forum.de/bmi-speedmanager-und-co-deaktivieren-als-webmaster-t292182.htm#3889392

1

BMI js it's not only on Vodafone. Verginmedia UK and T-Mobile UK also gives you this extra feature enabled as default and for free. ;-) In T-mobile it's called "Mobile Broadband Accelerator" You can Visit: http://accelerator.t-mobile.co.uk or http://1.2.3.50/ to configure it.

In case the above doesn't apply to you or for some reason it's not an option you could potentially set-up your local proxy (Polipo w/wo Tor) There is also a Firefox addon called "blocksite" or as more drastic approach reset tcp connection to 1.2.3.0/24:80 on your firewall. But unfortunately that wouldn't fix the damage.

Funny enough T-mobile and Verginmedia mobile/broadband support is not aware about this feature! (2011.10.11)

1

PHP: Header("Cache-Control: no-transform"); Thanks! I'm glad I found this page.

That Injector script was messing up my php page source code making me think I made an error in my php coding when viewing the page source. Even though the script was blocked with firefox NoScript add on. It was still messing up my code. Well, after that irritating dilemma, I wanted to get rid of it completely and not just block it with adblock or noscript firefox add ons or just on my php page.

  1. STOP http:// 1.2.3.4 Completely in Firefox: Get the add on: Modify Headers.
  2. Go to the modify header add on options... now on the Header Tab.
  3. Select Action: Choose ADD.
  4. For Header Name type in: cache-control
  5. For Header Value type in: no-transform
  6. For Comment type in: Block 1.2.3.4
  7. Click add... Then click Start.

The 1.2.3.4 script will not be injected into any more pages! yeah!

I no longer see 1.2.3.4 being blocked by NoScript. cause it's not there. yeah.

But I will still add: PHP: Header("Cache-Control: no-transform"); to my php pages.

0

If you are getting it on a site that you own or are developing, then you can simply override the function by setting it to null. This is what worked for me just fine.

bmi_SafeAddOnload = null;

As for getting it on other sites you visit, then you could probably open the devtools console and just enter that into there and wipe it out if a page is taking a long time to load. Haven't yet tested that though.

0

Ok nothing working to me. Then i replace image url every second because when my DOM updates, the problem is here again. Other solution is only use background style auto include in pages. Nothing is clean.

setInterval(function(){ imageUpdate(); }, 1000);

function imageUpdate() {
    console.log('######imageUpdate');
    var image = document.querySelectorAll("img");
    for (var num = 0; num < image.length; num++) {
        if (stringBeginWith(image[num].src, "http://1.1.1.1/bmi/***yourfoldershere***")) {
            var str=image[num].src;
            var res=str.replace("http://1.1.1.1/bmi/***yourfoldershere***", "");
            image[num].src = res;
            console.log("replace"+str+" by "+res);
            /*
            other solution is to push img src in data-src and push after dom loading all your data-src in your img src
            var data-str=image[num].data-src;
            image[num].src = data-str;
            */
            }
        }
}

function stringEndsWith(string, suffix) {
    return string.indexOf(suffix, string.length - suffix.length) !== -1
}
function stringBeginWith(string, prefix) {
    return string.indexOf(prefix, prefix.length-string.length) !== -1
}
0
-1

An effective solution that I found was to edit your hosts file (/etc/hosts on Unix/Linux type systems, C:\Windows\System32\drivers\etc on Windows) to have:

null 1.2.3.4

Which effectively maps all requests to 1.2.3.4 to null. Tested with my Crazy Johns (owned by Vofafone) mobile broadband. If your provider uses a different IP address for the injected script, just change it to that IP.

-1

Header("Cache-Control: no-transform");

use the above php code in your each php file and you will get rid of 1.2.3.4 code injection.

That's all.

I too was suffering from same problem, now it is rectified. Give a try.

0
-1

I added to /etc/hosts

1.2.3.4 localhost

Seems to have fixed it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.