Hacker News Reader

Comment by colinprince | Hacker News Reader

Can this be abused? Loading a page in a tab, I may not notice the URL changing from wickedsite.com to mybanksite.com, all without a reload.

View on HN

I don't think you can change the root domain, but I'll have to check that.

You're correct. Only the path (and not the domain) can be changed.

From the article:

* For security reasons, you can only change the path of the URL, not the domain itself. So you can change anything in the URL after my-domain.com/[change-the-stuff-here.html].

wouldn't this be better if you could only go to the same level or lower, thus preventing server/~user1 pretending to be server/~user2?

does this break real use cases?

Cookies have this problem, too (anyone from the same domain sees your cookies, and you can't really count on the cookie path). So does XMLHTTPRequest. Same origin[1] is pretty much the governing rule here; there wasn't any point in making pushState any more secure than the rest of the system.

1) http://en.wikipedia.org/wiki/Same_origin_policy

It very well could. Consider that "real use cases" includes every website in existence. Some of the have utterly horrifying URL schemes.

It's not just horrifying URL schemes, it would make the feature useless for any "web app" - take Grooveshark for example. A user can go from /artist/x/1234 to /song/x/1234 which seems pretty reasonable and not very horrifying.

As long as the script-file lives at / there's no problem..

Reply on news.ycombinator.com