How Do Sites Suppress Pasting Text?

Question

I've noticed that some sites (usually banks) suppress the ability to paste text into text fields. How is this done? I know that JavaScript can be used to swallow the keyboard shortcut for paste, but what about the right-click menu item?

Answer 1

Probably using the onpaste event, and either return false from it or use e.preventDefault() on the Event object.

Note that onpaste is non standard, don't rely on it for production sites, because it will not be there forever.

Answer 2

Even if it is somewhat possible to intercept the paste event in many browsers (but not all as shown at the link on the previous answer), that is quite unreliable and posible not complete (depending on the browser / OS it may be possible to do the paste operation in different ways that may not be trappable by javascript code).

Here is a collection of notes regarding paste (and copy) in the context of rich text editors that may be applied also elsewhere.