Hacker News Reader

Comment by jsharpe | Hacker News Reader

The article suggests that the page author has to explicitly request prerendering of a link with a "rel" attribute, possibly to avoid this problem.

View on HN

That makes sense, but it raised a question on my mind: What about malicious sites? Could this be used to do something without the user knowing?

One could mark a link as prefetch and that URL would be downloaded without prompting the user. Does that impose a genuine threat, or is that something that malicious sites can already do?

This can already be done by using a script or img tag load an arbitrary URL.

And if you have a well designed web app that can handle the extra volume, you can prefetch everything and get amazing response times.

Ack. Further research confirms your information:

http://code.google.com/chrome/whitepapers/prerender.html

Thanks for the heads up :)

Bust if you read the next section...

"Even if you do not proactively trigger prerendering yourself, it is still possible that another site will instruct Chrome to prerender your site. If your page is being prerendered, it may or may not ever be shown to the user (depending on if the user clicks the link)"

I posted similar concerns in a thread here yesterday which got little response.

Oh great - so non-deterministic behaviour adopted by the browser from instructions elsewhere. That's not good. Bring on the exploits!

Good job I've got a low IQ and use IE9 :)

I don't think it's actually any more powerful in that regard than, say, <iframe> tags. If your application lets users perform destructive actions with a GET request, you were already vulnerable.

This is true, but look at the state of most applications out there.

Reply on news.ycombinator.com