Is it safe to assume that Javascript is always enabled?

You should always make sure your site works without javascript.

People have disabled javascript for security reasons. Sometimes companies have to disable javascript on their computers. Also spiders don't have javascript, so your site doesn't work without javascript - this is bad SEO practice.

5% of users have JavaScript disabled.

It has become a standard in my office (for better or worse) to assume that the user has installed JS and enabled it. The number of people who have disabled it is getting smaller and smaller every day, but that still doesn't mean that you should give up doing the necessary validation to send on the server side, just in case (as well as some other scenarios).

I would say that it is unsafe to assume that javascript is always enabled, but it is safe to enable JavaScript.

In other words, you don't have to jump through hoops to get something to work without it, just display a message or redirect.

Javascript is an important technology and it is unwise to require it.

This is rare, but possible. If you are launching an application for "everyone" for use on the Internet, then yes, you will have to prepare for such an event. It really depends on your target audience, but the safest assumption is that someone will disable it.

From a security perspective, you definitely need to deal with this situation, as disabling JavaScript (or worse, hijacking scripts you write) can easily bypass business logic and validation unless it's double checked on the server.The requirement to be enabled is not good enough protection to stop people in this situation. Remember that you are asking the browser to inform you that it is enabled and disabled. The user (or attacker in this case) is in control of the browser and you cannot trust what he says as it is easy to change the HTTP headers.

Depending on who your target audience is. Some users have disabled JS for various reasons. Usually they will allow it for individual sites that need it, but they may not do it unless you tell them they need it.

If your site just doesn't load correctly, it will consider it broken. If it shows the message "you need JS to view this page", then at least they will know what to do.

Some of them will include Javascript for your site, but some will not, and they simply won't be able to use your site unless it works without Javascript.

This is rare, but it happens. It really depends on who your user base is. If it's for corporate users, many of them have default security settings with javascript disabled. If it's for ... pretty much anyone else, chances are it will be included.

I am running by default with javascript off for new sites (NoScript). I think a lot of technology-minded users are doing the same. At least those who are paranoid about XSS attacks.