4 ms·
To make 4. useful, links with the domain different than the open one should not be allowed to be added to History, otherwise you can bypass it with a different
by Xeanort 8y ago
To make 4. useful, links with the domain different than the open one should not be allowed to be added to History, otherwise you can bypass it with a different domain.
And without 4. this new limitation could be bypassed with a redirect (from the same domain).
- Ajedi32 8y ago> links with the domain different than the open one should not be allowed to be added to History This is already the case, and AFAIK it's always been this way. From [the HTML standard for pushState][1]: > Compare newURL to document's URL. If any component of these two URL records differ other than the path, query, and fragment components, then throw a "SecurityError" DOMException. [1]: https://html.spec.whatwg.org/multipage/history.html#dom-history-pushstate https://html.spec.whatwg.org/multipage/history.html#dom-hist...
- Xeanort 8y agoYou are right that they cannot be added to History, but the code used here changes the back button functionality with $(window).on('popstate', function() { window.location.href = 'https://example.com'; }); I just tested it and it works with different domain in latest Firefox.
- Ajedi32 8y agoFair point; popstate allows you to do pretty much anything when the history entry is for the current domain. That's not really an issue for this particular attack though, which relies on the reverse scenario: the user remaining on the current domain when they expected to navigate back to the third party search engine.