4 ms·
Huh...so you can add a third-party domain to the history? That seems like a security flaw. I would have imagined you could only add history for the current doma
by superb-owl 4y ago
Huh...so you can add a third-party domain to the history? That seems like a security flaw. I would have imagined you could only add history for the current domain.
- Spivak 4y agoThey can’t. Here’s the flow. 1. User goes to example.com. 2. The site immediately replaces the history state with example.com#history. 3. The site pushes a new history state example.com At this point your history looks like … google.com example.com#history example.com <— you are here 4. The user clicks their back button and you’re taken to example.com#history 5. The JS sees the hash and does a location.replace (i.e. navigate to) to some unrelated URL.
- Arrath 4y agoI despise websites that capture my back button.