Why Safari Requires Allowing JavaScript from Apple Events

This article explains why Apple requires users to manually enable the "Allow JavaScript from Apple Events" setting in the Safari web browser. It covers the security risks of automated scripts, how this feature protects your sensitive web data from malicious local software, and the exact steps needed to safely turn the setting on when you want to run legitimate AppleScripts or macOS Shortcuts.

The Core Reason: Security and Privacy

By default, Safari blocks external applications on your Mac from executing JavaScript within your active browser tabs. When you run an AppleScript or a macOS Shortcut that interacts with a webpage, it uses a macOS communication system called Apple Events to send that JavaScript to Safari.

Apple disables this capability out of the box to create a strict security boundary between your operating system and your web browser. JavaScript has the power to read, modify, and transmit anything happening on a webpage. If this setting were enabled by default, any program running on your Mac could silently inject code into your browser without your knowledge.

What This Setting Protects You From

Requiring manual activation prevents a variety of local attacks. If a malicious application or background process managed to get onto your Mac, and this Safari setting was not restricted, the rogue app could use Apple Events to:

  • Steal Session Data: Access authentication cookies to hijack your logged-in sessions for email, social media, or financial accounts.
  • Harvest Personal Information: Read sensitive text directly off the webpages you have open, such as credit card numbers, medical records, or private messages.
  • Perform Unauthorized Actions: Silently click buttons, submit forms, or transfer funds on websites where you are already authenticated.
  • Bypass Two-Factor Authentication: Wait for you to log into a secure site and then immediately take over the session using injected scripts.

To prevent malware from simply turning this feature on by itself via a background script, Apple placed the toggle inside the hidden Develop menu and locked it behind an operating system authentication prompt.

Because a user must physically open Safari’s settings, reveal the Develop menu, click the option, and enter their Mac's administrator password or use Touch ID, macOS guarantees that a real human is intentionally authorizing browser automation.

How to Enable the Setting for Legitimate Scripts

If you trust the AppleScript or Shortcut you are trying to run, you only need to enable this setting once.

  1. Open Safari.
  2. Click Safari in the top menu bar and select Settings (or Preferences on older macOS versions).
  3. Go to the Advanced tab.
  4. Check the box at the bottom that says Show features for web developers (or Show Develop menu in menu bar).
  5. Close the Settings window.
  6. Click Develop in the top menu bar.
  7. Click Allow JavaScript from Apple Events so that a checkmark appears next to it.
  8. Enter your Mac password or use Touch ID when prompted to confirm the change.

Once enabled, your AppleScripts and Shortcuts will be able to communicate with Safari and execute custom JavaScript seamlessly. If you ever stop using browser automations, it is best practice to click the setting again to turn it off.