Always Stay Online and Active on Slack with WebSocket Framejacking

Even though Slack is on a dedicated monitor beside you, if you’re not focused on it, you’ll appear “away” and “not at your computer.” Do you subconsciously think team members are sleeping when they appear away at 10 am? Let’s always be active until we close the Slack tab or manually set ourselves as away. This is fair: Slack is open somewhere, so we are active.

Am I really away or offline when I’m in a different window?

By changing just four characters in Slack, we can always stay active without going inactive, even after hours with a minimized browser.

Are There Existing Solutions?

Let’s see what solutions exist or we can think of before we analyze an extremely simple and effective solution.

One solution requires giving away your user name and password to an online service that pretends to be you just enough to convince Slack you are active. Who is to know how safe this is? This doesn’t work for Enterprise Slack that uses SSO authentication.

Another solution is to open Slack in the foreground on your phone and never let your phone sleep. You’ll need a phone and charger.

Yet another solution is to open the Slack desktop app and use a mouse jiggler to prove to Slack you are active and awake. You’d need hardware or some way to nudge your mouse now and then, plus the desktop app.

Others have even written Python, Java, NodeJS, etc. code to generate faux user activity via the Slack API with a personal API key. This seems like a neat idea, but the API changes now and then, and it is unclear how to change the user status. We don’t have Enterprise Slack access to the API.

You might consider writing a self-refreshing iframe that just loads Slack over and over again. Slack sets the X-Frame-Options header to sameorigin, so Slack will not even load in an iframe. Good thinking, though.

Another interesting solution is to fire up a web-testing framework like Selenium to load a headless browser that “clicks” around Slack now and again. Some steps are needed to enter your credentials (and hope the UI doesn’t change and a Captcha doesn’t appear), plus the programming knowledge required is high. This likely doesn’t work with Enterprise Slack and SSO authentication.

Let’s Arrive at a Neat Solution Together

As a rewarding read, let’s arrive at this solution together by asking ourselves some questions.

Let’s open Chrome DevTools and watch the console, XHR network requests, and WebSocket frames.

We see that when the browser loses focus and then regains focus, some console messages appear. However, there are no corresponding WebSocket messages.

Let’s try that. We can easily remove all blur event listeners using DevTools like so.

When we focus on another window or minimize the Slack window, no blur events fire. So far, so good. Now we wait for thirty minutes to see if we go inactive.

Some time goes by…

Darn. We went inactive. Let’s see what network requests took place.

There were no unusual XHR requests, but the WebSocket frames are interesting.

Notice these are response frames. The server told us we went inactive—no browser event triggered it.

Let’s check messages when we return to an inactive Slack window.

The server told us we became active as soon as we entered (focused) the browser tab.

Let’s click around Slack channels and type messages while watching the WebSocket.

We see a typing message when we start typing, and a tickle message when we blur, refocus, then click. These are the only two benign events that signal activity.

No. Each sent frame has a sequential id, so we can’t replay them via setInterval().

We might track the current id and send one with id + 1, but that would likely invalidate the next genuine frame or clash with the asynchronous Slack Service Worker.

It’s unclear if sequence IDs persist across reconnections or reset per socket. Slack could also change the pattern at any time—say, even-numbered IDs instead of odd. Let’s assume IDs are unpredictable and move on.

Reviewing background traffic shows candidates for framejacking—hijacking single-frame WebSocket messages, as most Slack messages fit in one frame.

Ping! Every ten seconds or so a ping is sent to the server and a pong is received. A ping message has the same format as the tickle message.

Let’s try spoofing a tickle message by replacing the four characters “ping” with “tickle” in framejacked ping messages every few minutes (more on that soon). This approach could be simple and elegant.

Yes and no. Granted, it’s trivial to MITM WebSockets—intercepting them and modifying messages. However, WebSockets close, reopen, or get killed over time, so we must invest effort to always framejack the correct socket.

No. Over the day, many sockets are created—you’d end up with stacked setInterval() timers that misbehave if variables go out of scope.

A better approach is to skip timers entirely and use timestamps: each incoming message triggers an elapsed-time check to send faux activity.

Yes. Slack uses a heartbeat protocol: it sends a ping every ten seconds and expects a matching pong. If no pong arrives within ninety seconds, the client closes the socket.

We shouldn’t modify Slack’s JavaScript or hack private variables. Could we simply prevent the socket from closing? I tried editing Slack’s cached JS file.

After framejacking one ping, no more pings were sent—and Slack stopped working soon after.

Instead, let’s intercept the ping, convert it to a tickle, and inject a well-crafted pong into the WebSocket layer so the client-side JavaScript remains satisfied.

It’s trivial to spoof a pong from the DevTools console. But, we shouldn’t settle for sending a simple JSON string—we want to forge a trusted EventMessage with all the attributes of a real message received on the wire. That makes our solution future-proof.

You can’t simply forge a trusted EventMessage object (a real WebSocket message) and modify it. You must engineer a way to tamper with a read-only event—making its data attribute writeable so it returns a valid pong.

Admit it—forging a trusted message is exciting. We saved a reference to a real pong (which is hard to clone) and made its data attribute writeable.

Yes. Slack uses a Service Worker running in its own background thread. Service Workers handle alerts, chart updates, data sync, and more.

Below is a console log showing the script working while the browser is minimized and hidden.

The Slack: Always Stay Active Script

We only need Chrome (or Brave) and the popular browser extension Tampermonkey¹ to inject JavaScript on Slack pages.

What began as a proof of concept now includes visual feedback and integrity checks to warn us if Slack changes something critical. You can stop the script remotely on all your browsers on all your machines, and you can still set yourself away manually. The script is organized for easy review and verification. Enjoy.

Quick Start

A thin orange line appears while Slack boots. It turns green when active.

If it turns red, internal sanity checks failed signalling Slack has changed something major. This design is future-proof. If Slack renames tickle to, say, caress or nudge, you can update the script accordingly.

Advanced Features

Send yourself these messages to control the script across all of your open Slack windows:

1. sigkill! – close all your open Slack windows
2. sighup! – refresh all your open Slack windows

Console Commands

Test the script from the DevTools console:

1. slackasa.ticklenow() – framejack the next pong to signal activity now
2. slackasa.listsockets() – list all open sockets and their timestamps
3. slackasa.reload() – reload the page

Installation Steps

Step 1. Add Tampermonkey to Chrome.

Step 2. Create a new empty userscript without saving.

Step 3. Copy and paste the script at the bottom of the page. Save. Close Tampermonkey.

Step 4. Visit Slack. Find the Tampermonkey icon, and enable Tempermonkey and the ‘Slack: Always Stay Active’ userscript. Reload Slack.

Discussion

This began as a mental exercise to keep Slack active. I use web Slack constantly—open on multiple computers and my phone—so I trigger activity at least every thirty minutes.

Yet sometimes I’m engrossed in my IDE for long stretches. Even with Slack on a dedicated monitor beside me, I appear “away” and “not at my computer”—far from the truth. Does this happen to you, too?

Full Script

This was written and developed in vanilla JavaScript in the Tampermonkey script editor in my spare time over the weekend. Encapsulation isn’t perfect as it’s not transpiled from TypeScript. The goal is to make it easy to read and understand. Why not publish this script? To require users to examine the code and verify it is safe as a habit. If you share this script, kindly attribute it. Thank you.

Copy script to clipboard