6 ms·
wouldn't this be better if you could only go to the same level or lower, thus preventing server/~user1 pretending to be server/~user2? does this break real use
by d4rt 16y ago
wouldn't this be better if you could only go to the same level or lower, thus preventing server/~user1 pretending to be server/~user2?
does this break real use cases?
- novas0x2a 16y agoCookies have this problem, too (anyone from the same domain sees your cookies, and you can't really count on the cookie path). So does XMLHTTPRequest. Same origin[1] is pretty much the governing rule here; there wasn't any point in making pushState any more secure than the rest of the system. 1) http://en.wikipedia.org/wiki/Same_origin_policy http://en.wikipedia.org/wiki/Same_origin_policy
- Groxx 16y agoIt very well could. Consider that "real use cases" includes every website in existence. Some of the have utterly horrifying URL schemes.
- wanderr 16y agoIt's not just horrifying URL schemes, it would make the feature useless for any "web app" - take Grooveshark for example. A user can go from /artist/x/1234 to /song/x/1234 which seems pretty reasonable and not very horrifying.
- mseebach 16y agoAs long as the script-file lives at / there's no problem..