4 ms·
Another possibility - if the referring page is a different domain, overriding back is ineffective (the browser just does a “real” back in these cases).
by yashap 8y ago
Another possibility - if the referring page is a different domain, overriding back is ineffective (the browser just does a “real” back in these cases).
- Ajedi32 8y agoI don't understand. Are you suggesting that if you arrive at a site from Google, the history API should just not work? For example, let's say a user arrives at a single-page application from Google, and clicks a link on that page to get more information. The site adds a history entry with pushState, but doesn't reload the entire page. Are you saying that in this case, when the user clicks back they should get sent back to Google instead of to the site's home page? If so, that seems like rather unexpected behavior. And if not, isn't the attack still viable?