5 ms·

HTML5: Changing the browser-URL without refreshing page

92 points by twampss 16y ago

colinprince 16y ago
Can this be abused? Loading a page in a tab, I may not notice the URL changing from wickedsite.com to mybanksite.com, all without a reload.
- pepijndevos 16y ago
  I don't think you can change the root domain, but I'll have to check that.
  - j79 16y ago
    You're correct. Only the path (and not the domain) can be changed. From the article: * For security reasons, you can only change the path of the URL, not the domain itself. So you can change anything in the URL after my-domain.com/[change-the-stuff-here.html].
    - d4rt 16y ago
      wouldn't this be better if you could only go to the same level or lower, thus preventing server/~user1 pretending to be server/~user2? does this break real use cases?
      - novas0x2a 16y ago
        Cookies have this problem, too (anyone from the same domain sees your cookies, and you can't really count on the cookie path). So does XMLHTTPRequest. Same origin[1] is pretty much the governing rule here; there wasn't any point in making pushState any more secure than the rest of the system. 1) http://en.wikipedia.org/wiki/Same_origin_policy http://en.wikipedia.org/wiki/Same_origin_policy
      - Groxx 16y ago
        It very well could. Consider that "real use cases" includes every website in existence. Some of the have utterly horrifying URL schemes.
        wanderr 16y ago
        It's not just horrifying URL schemes, it would make the feature useless for any "web app" - take Grooveshark for example. A user can go from /artist/x/1234 to /song/x/1234 which seems pretty reasonable and not very horrifying.
        mseebach 16y ago
        As long as the script-file lives at / there's no problem..
MikeW 16y ago
What about all the services offering provider.com/~username. Scrolling status bars used to be all the range in the 90s, I wonder how long until url hacks allow for scrolling address bars with this.
- deleted 16y ago
  [deleted]
- johnswamps 16y ago
  Here you go. Copy paste into your url bar. Only tested in Chrome (edit: apparently also works in safari 5) javascript:var dashes = ""; var num = 20; while(--num) dashes += "-"; setInterval(function() { window.history.pushState("", "", dashes.slice(0, num % 20) + "foo" + dashes.slice(num % 20)); num++;}, 500)
  - e1ven 16y ago
    That is simultaneously one of the cooler, and more horrifying things I have seen. With Great Power, comes great potential for horrible, horrible abuse.
    - j79 16y ago
      Absolutely. I was thinking this could be "abused" in the same way that animated status bars were in the 90s. Of course, I had to try it out... javascript:var s=[119,101,108,99,111,109,101,45,116,111,45,104,97,99,107,101,114,45,110,101,119,115];var c=1;var mod=s.length+1;setInterval(function(){window.history.replaceState("","", setString())}, 200);function setString(){var n="";if(!(c % mod)){c=1}else{c++}for(i=0;i<s.length;i++){n+=String.fromCharCode(s[i]-(s[i]==45||i!=c-1?0:32))}return n+".aspx!!!"};
  - ptomato 16y ago
    Also works in Safari 5, at least.
  - kristofferR 16y ago
    Damn, that is annoying! It totally screws up the back button functionality in Safari: http://imgur.com/41rrV.png http://imgur.com/41rrV.png
deleted 16y ago
[deleted]
drivebyacct2 16y ago
This is fantastic. I had no idea this was part of HTML5. Do I have to log in to Flickr to try the new layout?
korch 16y ago
This is the greatest html5 feature I've never heard of, and it's really going to change how everybody make web apps. Here's my wild prediction: 10 years from now, with the benefit of hindsight, we will trace the moment where Google's Page Rank empire started to crumble to the introduction of this html5 feature. However, discovering this makes me wonder what other incredibly useful but as yet unknown html5 features are out there in the wild?
- gojomo 16y ago
  How does this feature make much difference to Page Rank (or the many other ranking factors now as important or moreso for Google)?
  - korch 16y ago
    By decoupling urls in the browser from urls in the web app, it's only going to increase the amount of content in the Deep Web that Google can't index. I imagine it'll be difficult to make GoogleBot crawl and index "pages" after large swaths of the web are using this. And once this Javascript feature is in jQuery, then we can expect a huge number of web developers to start using it by default. I don't know how much Javascript the GoogleBot currently parses and/or executes, but I imagine it would be enormously complex to embed v8 into the crawler, and then execute all Javascript on every page and determine what to index on a "page." If we ever get to the point where you can't screen scrape a web app without also executing its Javascript, then PageRank-like methods become less effective, and we'll need more semantic approaches to search. It's a great thing such semantic approaches don't yet exist!
    - gojomo 16y ago
      Some Google crawls already execute Javascript; they could easily do so more extensively if that were the only way to reach valuable content. Also, Google is already promoting a convention for making the various parts of an AJAX application reachable via different URL-#fragments more easily crawlable. See: http://www.google.com/support/webmasters/bin/answer.py?hl=en&answer=174992 http://www.google.com/support/webmasters/bin/answer.py?hl=en... A number of sites including Facebook have adopted this convention; app developers usually want to be found by search engines.
fortes 16y ago
I'm happy to see this is going to be implemented by the browsers of the future. I've started a project to port the API to older browsers: http://github.com/fortes/history.js http://github.com/fortes/history.js Patches welcome!
deleted 16y ago
[deleted]

92 points by twampss 16y ago

Can this be abused? Loading a page in a tab, I may not notice the URL changing from wickedsite.com to mybanksite.com, all without a reload.

pepijndevos 16y ago
I don't think you can change the root domain, but I'll have to check that.
- j79 16y ago
  You're correct. Only the path (and not the domain) can be changed. From the article: * For security reasons, you can only change the path of the URL, not the domain itself. So you can change anything in the URL after my-domain.com/[change-the-stuff-here.html].
  - d4rt 16y ago
    wouldn't this be better if you could only go to the same level or lower, thus preventing server/~user1 pretending to be server/~user2? does this break real use cases?
    - novas0x2a 16y ago
      Cookies have this problem, too (anyone from the same domain sees your cookies, and you can't really count on the cookie path). So does XMLHTTPRequest. Same origin[1] is pretty much the governing rule here; there wasn't any point in making pushState any more secure than the rest of the system. 1) http://en.wikipedia.org/wiki/Same_origin_policy http://en.wikipedia.org/wiki/Same_origin_policy
    - Groxx 16y ago
      It very well could. Consider that "real use cases" includes every website in existence. Some of the have utterly horrifying URL schemes.
      - wanderr 16y ago
        It's not just horrifying URL schemes, it would make the feature useless for any "web app" - take Grooveshark for example. A user can go from /artist/x/1234 to /song/x/1234 which seems pretty reasonable and not very horrifying.
        mseebach 16y ago
        As long as the script-file lives at / there's no problem..

MikeW 16y ago

What about all the services offering provider.com/~username. Scrolling status bars used to be all the range in the 90s, I wonder how long until url hacks allow for scrolling address bars with this.

deleted 16y ago
[deleted]
johnswamps 16y ago
Here you go. Copy paste into your url bar. Only tested in Chrome (edit: apparently also works in safari 5) javascript:var dashes = ""; var num = 20; while(--num) dashes += "-"; setInterval(function() { window.history.pushState("", "", dashes.slice(0, num % 20) + "foo" + dashes.slice(num % 20)); num++;}, 500)
- e1ven 16y ago
  That is simultaneously one of the cooler, and more horrifying things I have seen. With Great Power, comes great potential for horrible, horrible abuse.
  - j79 16y ago
    Absolutely. I was thinking this could be "abused" in the same way that animated status bars were in the 90s. Of course, I had to try it out... javascript:var s=[119,101,108,99,111,109,101,45,116,111,45,104,97,99,107,101,114,45,110,101,119,115];var c=1;var mod=s.length+1;setInterval(function(){window.history.replaceState("","", setString())}, 200);function setString(){var n="";if(!(c % mod)){c=1}else{c++}for(i=0;i<s.length;i++){n+=String.fromCharCode(s[i]-(s[i]==45||i!=c-1?0:32))}return n+".aspx!!!"};
- ptomato 16y ago
  Also works in Safari 5, at least.
- kristofferR 16y ago
  Damn, that is annoying! It totally screws up the back button functionality in Safari: http://imgur.com/41rrV.png http://imgur.com/41rrV.png

deleted 16y ago

[deleted]

drivebyacct2 16y ago

This is fantastic. I had no idea this was part of HTML5. Do I have to log in to Flickr to try the new layout?

korch 16y ago

This is the greatest html5 feature I've never heard of, and it's really going to change how everybody make web apps. Here's my wild prediction: 10 years from now, with the benefit of hindsight, we will trace the moment where Google's Page Rank empire started to crumble to the introduction of this html5 feature. However, discovering this makes me wonder what other incredibly useful but as yet unknown html5 features are out there in the wild?

gojomo 16y ago
How does this feature make much difference to Page Rank (or the many other ranking factors now as important or moreso for Google)?
- korch 16y ago
  By decoupling urls in the browser from urls in the web app, it's only going to increase the amount of content in the Deep Web that Google can't index. I imagine it'll be difficult to make GoogleBot crawl and index "pages" after large swaths of the web are using this. And once this Javascript feature is in jQuery, then we can expect a huge number of web developers to start using it by default. I don't know how much Javascript the GoogleBot currently parses and/or executes, but I imagine it would be enormously complex to embed v8 into the crawler, and then execute all Javascript on every page and determine what to index on a "page." If we ever get to the point where you can't screen scrape a web app without also executing its Javascript, then PageRank-like methods become less effective, and we'll need more semantic approaches to search. It's a great thing such semantic approaches don't yet exist!
  - gojomo 16y ago
    Some Google crawls already execute Javascript; they could easily do so more extensively if that were the only way to reach valuable content. Also, Google is already promoting a convention for making the various parts of an AJAX application reachable via different URL-#fragments more easily crawlable. See: http://www.google.com/support/webmasters/bin/answer.py?hl=en&answer=174992 http://www.google.com/support/webmasters/bin/answer.py?hl=en... A number of sites including Facebook have adopted this convention; app developers usually want to be found by search engines.

fortes 16y ago

I'm happy to see this is going to be implemented by the browsers of the future. I've started a project to port the API to older browsers: http://github.com/fortes/history.js http://github.com/fortes/history.js Patches welcome!

deleted 16y ago

[deleted]