&gt; There will always be a way to hide &#x2F; obfuscate the action, making it seem to the browser that it was user-initiated.<p>How? This security mechanism has been used for (among other things) popups for years now, and the only way it&#x27;s been worked around is by attaching click handlers to links the user is likely to click.