News for hackers. Stuff that matters.
Re:A new spam policy for "back button hijacking" by al_borland on Monday April 13, 2026 @11:45PM (#47761003)
Some Microsoft sites have been very guilty of this. They are the ones that stick in my head in recent memory.
Re:A new spam policy for "back button hijacking" by lamasery on Tuesday April 14, 2026 @12:06AM (#47761118)
IIRC the Azure “portal” does this. Also likes to not record things as navigation events that really feel like they should be. Hitting back on that thing is like hitting the back button on Android, it’s the “I feel lucky” button. Anything could happen.
Re:A new spam policy for "back button hijacking" by PhageGenerator on Tuesday April 14, 2026 @01:22AM (#47761568)
I think that is because some "pages" are really full screen modals. So the back button does take you back to the previous page, but it looks like you went back two pages (closes modal + goes back). I don't spend too much time in the Azure portal but this behavior is rampant in the Entra admin center.
Re:A new spam policy for "back button hijacking" by TeMPOraL on Tuesday April 14, 2026 @04:09AM (#47762739)
> full screen modals

Thanks. I never imagined this is a thing, it's an useful addition to my mental model of software components, to explain why back button on web behaves in weird ways for some apps.

But it sure does sound like a dumb pattern on the web.

Re:A new spam policy for "back button hijacking" by notpushkin on Tuesday April 14, 2026 @04:58AM (#47763045)
While we’re making sure that modals are recorded in history so that you can close them with the back button on mobile (e.g. https://svelte.dev/docs/kit/shallow-routing), MSFT can’t be bothered. But when it comes to abusing the very same history API to grab the user’s attention for a bit longer...
Re:A new spam policy for "back button hijacking" by boomlinde on Tuesday April 14, 2026 @07:48AM (#47764367)
Having used Azure I believe that this is the result of pure, distilled incompetence rather than malicious intent.
Re:A new spam policy for "back button hijacking" by al_borland on Tuesday April 14, 2026 @11:55PM (#47774532)
This maybe true, but I don’t think a company as large as Microsoft can get a pass. There is no excuse for them not being able to handle a back button properly. They are worth trillions of dollars, run some of the biggest sites on the internet, and defined much of how the web worked for an entire computing era.

They should have their feet held to the fire on this.

Re:A new spam policy for "back button hijacking" by boomlinde on Wednesday April 15, 2026 @02:01AM (#47775237)
Hear, hear.

I mention it not to excuse Microsoft's sins, but to the contrary to point out that malicious intent as a criteria isn't such a good idea after all, when there are such obvious cases of incompetence and malice being practically indistinguishable.

Re:A new spam policy for "back button hijacking" by 542458 on Tuesday April 14, 2026 @12:05AM (#47761106)
Are they? This seems about deceptive or malicious content (i.e., redirecting to ads) rather than “something in my history triggers a JS redirect”. I’ve definitely experienced the latter with MS, but never the former.
Re:A new spam policy for "back button hijacking" by surround on Tuesday April 14, 2026 @12:18AM (#47761184)
It seems like Google's policy is unconcerned with the intent of the practice. If a website JS redirect ruins the user experience by breaking the back button, it will be demoted in search results. It doesn't matter whether or not the redirect was meant to be deceptive or malicious, websites shouldn't be ruining the user experience.
Re:A new spam policy for "back button hijacking" by dataflow on Tuesday April 14, 2026 @01:13AM (#47761496)
> It seems like Google's policy is unconcerned with the intent of the practice.

I'm reading the opposite: "If you're currently using any script or technique that inserts or replaces deceptive or manipulative pages into a user's browser history that [...]"

Re:A new spam policy for "back button hijacking" by j16sdiz on Tuesday April 14, 2026 @02:33AM (#47762012)
This is Google. Most likely they will deploy an automatic scanner bot that "supposed to" handle all the edge cases. When it don't work, you will be blamed for not writing your js in the way the bot can understand.
Re:A new spam policy for "back button hijacking" by sixothree on Tuesday April 14, 2026 @12:02AM (#47761091)
Epic store makes it impossible to navigate backwards from the checkout on mobile at least. Not sure if it's design or just poor design.
Re:A new spam policy for "back button hijacking" by quantum_magpie on Tuesday April 14, 2026 @06:48AM (#47763887)
I think most checkouts do that, to prevent duplicate payments. Dunno about epic, but I often encounter that mitigated by a dedicated ‘go back to store’ button post-checkout
Re:A new spam policy for "back button hijacking" by SuperNinKenDo on Tuesday April 14, 2026 @12:37AM (#47761302)
Happened to me yesterday through a link off here. I was already expecting it given the domain, but usually mashing back fast enough does the trick eventually. Not this time. Had to kill the tab.
Re:A new spam policy for "back button hijacking" by Tepix on Tuesday April 14, 2026 @01:08AM (#47761463)
In most browsers you can hold the back button for a second and it will let you skip back more than one step.
Re:A new spam policy for "back button hijacking" by AndrewDucker on Tuesday April 14, 2026 @02:12AM (#47761860)
You can right-click on the back button in Firefox to see a list of previous sites to go back to.
Re:A new spam policy for "back button hijacking" by notpushkin on Tuesday April 14, 2026 @05:00AM (#47763060)
Yeah, it’s the same feature, just two different gestures. (And long tap works with Firefox on Android, btw.)
Re:A new spam policy for "back button hijacking" by Kab1r on Tuesday April 14, 2026 @01:14AM (#47761507)
And some websites consume the entire history that a browser displays in that menu
Re:A new spam policy for "back button hijacking" by SuperNinKenDo on Tuesday April 14, 2026 @12:38PM (#47767906)
Has definitely happened to me. Especially if I try the "click back a couple times quickly" method first.
Re:A new spam policy for "back button hijacking" by SuperNinKenDo on Tuesday April 14, 2026 @12:37PM (#47767890)
Probably should have mentioned it, but I was on my phone browser where that option either doesn't exist or isn't surfaced well. A long press on the back button just does the same thing as tapping once, so I'm all out of ideas.
Re:A new spam policy for "back button hijacking" by NetMageSCW on Tuesday April 14, 2026 @03:59PM (#47770680)
Probably should also mention which phone browser on which phone OS.
Re:A new spam policy for "back button hijacking" by SuperNinKenDo on Wednesday April 15, 2026 @10:38AM (#47779648)
Why on earth would I go out of my way to publicise that information in a public forum?
Re:A new spam policy for "back button hijacking" by UntappedShelf21 on Tuesday April 14, 2026 @11:02PM (#47774209)
Microsoft Learn. I first noticed this a couple years ago not long after they changed the url from docs.microsoft.com to learn.microsoft.com. Each time you went from a google search to a learn page it would load, redirect to login.microsoftonline then go back to the learn page. Hitting back in the browser took you back to login.microsoftonline which forwarded you back to the learn page. Hitting back twice in quick succession took you back to the docs page then forwarded you to login.microsoftonline. Easier to close the tab and start again. Maybe it was something to do with the changes to the site to make it more like an online college, as that portion requires signin, but I’m just after first party doco! Dunno if this still happens today but at the time I was browsing docs every other day and it was super frustrating. Note: it only did this if you were already signed in elsewhere, something triggered Microsoft sso check. Similar to if you go to portal.office.com, it is a page that requires sign in and so does the login.microsoftonline redirect to check for active tokens.