If I type http://domain.com/product/5 into my browser I will see the product details in the main div plus a side bar div containing links to other products. This side bar is common to all product views. I click a sidebar link to product 6 and an ajax request updates the main cell with the product 6 information. My location bar will still say /product/5. If I refresh the browser I will see product 5. If I bookmark the page it will be for product 5. If I click the back button I will go to the page I saw before product 5. I know none of these problems with AJAX are new. Why is it that JavaScript can't tell the browser "Now you are looking at http://domain.com/product/6"? Is there a security risk? Is this just something not yet implemented?
On 7 Jul 2006 12:48:00 -0700, petermich...@gmail.com wrote:
> Why is it that JavaScript can't tell the >browser "Now you are looking at http://domain.com/product/6"? Is there >a security risk? Is this just something not yet implemented?
It's a security risk, the URL needs to reflect where you are:
petermich...@gmail.com wrote: > Why is it that JavaScript can't tell the > browser "Now you are looking at http://domain.com/product/6"? Is there > a security risk?
Most certainly.
If javascript could change the url displayed by the browser, yet not actually cause it to make a request and load the new page, I could make a fake Paypal sign-on page, for example, and change the url to www.paypal.com - you wouldn't even know the difference!
The challenges you face with Ajax are just some issues you need to consider in the design. If you want bookmarkable pages, don't use ajax. Or provide a link to the permanent url which represents the view you are seeing, so it can be bookmarked. Etc.
Matt Kruse wrote: > petermich...@gmail.com wrote: > > Why is it that JavaScript can't tell the > > browser "Now you are looking at http://domain.com/product/6"? Is there > > a security risk?
> Most certainly.
> If javascript could change the url displayed by the browser, yet not > actually cause it to make a request and load the new page, I could make a > fake Paypal sign-on page, for example, and change the url to > www.paypal.com - you wouldn't even know the difference!
> The challenges you face with Ajax are just some issues you need to consider > in the design. If you want bookmarkable pages, don't use ajax. Or provide a > link to the permanent url which represents the view you are seeing, so it > can be bookmarked. Etc.
Jim Ley wrote: > On 7 Jul 2006 12:48:00 -0700, petermich...@gmail.com wrote:
> > Why is it that JavaScript can't tell the > >browser "Now you are looking at http://domain.com/product/6"? Is there > >a security risk? Is this just something not yet implemented?
> It's a security risk, the URL needs to reflect where you are:
