HTML5 Developer’s Cookbook (Gal Zentner's Library) by Chuck Hudson & Tom Leadbetter

Author:Chuck Hudson & Tom Leadbetter
Language: eng
Format: epub
Publisher: Addison-Wesley
Published: 2012-02-16T16:00:00+00:00

Intermediate Recipe: Testing History Security

Any time you are able to modify the browser history, page title, and URL address, you need to think about security. Changing URL addresses has historically been one of the more common phishing methods, also known as website forgery. The new History API provides developers for the first time a method to change the content of a URL without actually loading a page. However, the HTML5 specification includes safeguards for the various browsers to follow and protect against the misuse of the History API:

• A script cannot set a domain in the URL of pushState and replaceState different from the current domain.

• The popstate event can reference only state objects stored in the history by pages with the same domain origin in order to maintain privacy across sites.

• A limit is placed on the number of entries a page may add to the browser history stack through the pushState method to prevent “flooding” the history of the user’s browser.

Through these browser policies, the possible malicious use of the History API should be minimized. Let’s verify one of these policies by trying to change the URL to a different domain.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.