News for hackers. Stuff that matters.

A comment on HTML5: Changing the browser-URL without refreshing page. Parent comment

Re:HTML5: Changing the browser-URL without refreshing page by d4rt on Wednesday July 21, 2010 @04:36PM (#1536470)
wouldn't this be better if you could only go to the same level or lower, thus preventing server/~user1 pretending to be server/~user2?

does this break real use cases?

[ Parent | on HN ]
Re:HTML5: Changing the browser-URL without refreshing page by novas0x2a on Wednesday July 21, 2010 @04:58PM (#1536533)
Cookies have this problem, too (anyone from the same domain sees your cookies, and you can't really count on the cookie path). So does XMLHTTPRequest. Same origin[1] is pretty much the governing rule here; there wasn't any point in making pushState any more secure than the rest of the system.

1) http://en.wikipedia.org/wiki/Same_origin_policy

[ Parent | on HN ]
Re:HTML5: Changing the browser-URL without refreshing page by Groxx on Thursday July 22, 2010 @02:07AM (#1537491)
It very well could. Consider that "real use cases" includes every website in existence. Some of the have utterly horrifying URL schemes.
[ Parent | on HN ]
Re:HTML5: Changing the browser-URL without refreshing page by wanderr on Thursday July 22, 2010 @05:11AM (#1537732)
It's not just horrifying URL schemes, it would make the feature useless for any "web app" - take Grooveshark for example. A user can go from /artist/x/1234 to /song/x/1234 which seems pretty reasonable and not very horrifying.
[ Parent | on HN ]
Re:HTML5: Changing the browser-URL without refreshing page by mseebach on Thursday July 22, 2010 @06:35AM (#1537816)
As long as the script-file lives at / there's no problem..
[ Parent | on HN ]