3 ms·

I see prefetching of doom again. I hope they have thought about the obvious problem this can cause when the browser spiders all the links on the page: People

I see prefetching of doom again. I hope they have thought about the obvious problem this can cause when the browser spiders all the links on the page: People using the GET verb for deletions. Bad practice but common as dirt. Ouch!

jsharpe 15y ago
The article suggests that the page author has to explicitly request prerendering of a link with a "rel" attribute, possibly to avoid this problem.
- pointyhat 15y ago
  Ack. Further research confirms your information: http://code.google.com/chrome/whitepapers/prerender.html http://code.google.com/chrome/whitepapers/prerender.html Thanks for the heads up :)
  - rednaught 15y ago
    Bust if you read the next section... "Even if you do not proactively trigger prerendering yourself, it is still possible that another site will instruct Chrome to prerender your site. If your page is being prerendered, it may or may not ever be shown to the user (depending on if the user clicks the link)" I posted similar concerns in a thread here yesterday which got little response.
    - pointyhat 15y ago
      Oh great - so non-deterministic behaviour adopted by the browser from instructions elsewhere. That's not good. Bring on the exploits! Good job I've got a low IQ and use IE9 :)
      - andfarm 15y ago
        I don't think it's actually any more powerful in that regard than, say, <iframe> tags. If your application lets users perform destructive actions with a GET request, you were already vulnerable.
        pointyhat 15y ago
        This is true, but look at the state of most applications out there.
- malvim 15y ago
  That makes sense, but it raised a question on my mind: What about malicious sites? Could this be used to do something without the user knowing? One could mark a link as prefetch and that URL would be downloaded without prompting the user. Does that impose a genuine threat, or is that something that malicious sites can already do?
  - ryanpetrich 15y ago
    This can already be done by using a script or img tag load an arbitrary URL.
- smackfu 15y ago
  And if you have a well designed web app that can handle the extra volume, you can prefetch everything and get amazing response times.

jsharpe 15y ago

The article suggests that the page author has to explicitly request prerendering of a link with a "rel" attribute, possibly to avoid this problem.

pointyhat 15y ago
Ack. Further research confirms your information: http://code.google.com/chrome/whitepapers/prerender.html http://code.google.com/chrome/whitepapers/prerender.html Thanks for the heads up :)
- rednaught 15y ago
  Bust if you read the next section... "Even if you do not proactively trigger prerendering yourself, it is still possible that another site will instruct Chrome to prerender your site. If your page is being prerendered, it may or may not ever be shown to the user (depending on if the user clicks the link)" I posted similar concerns in a thread here yesterday which got little response.
  - pointyhat 15y ago
    Oh great - so non-deterministic behaviour adopted by the browser from instructions elsewhere. That's not good. Bring on the exploits! Good job I've got a low IQ and use IE9 :)
    - andfarm 15y ago
      I don't think it's actually any more powerful in that regard than, say, <iframe> tags. If your application lets users perform destructive actions with a GET request, you were already vulnerable.
      - pointyhat 15y ago
        This is true, but look at the state of most applications out there.
malvim 15y ago
That makes sense, but it raised a question on my mind: What about malicious sites? Could this be used to do something without the user knowing? One could mark a link as prefetch and that URL would be downloaded without prompting the user. Does that impose a genuine threat, or is that something that malicious sites can already do?
- ryanpetrich 15y ago
  This can already be done by using a script or img tag load an arbitrary URL.
smackfu 15y ago
And if you have a well designed web app that can handle the extra volume, you can prefetch everything and get amazing response times.