logoalt Hacker News

miki123211 • 10/10/2024 • 2 replies • view on HN

> I don’t know how it’d be possible to do that

It isn't, at least not in the way you think.

Visited links have always looked different from unvisited ones, and the moment you could customize how links looked via CSS, browsers also had to implement styling for visited links specifically.

Modern browsers put a lot of care into making the changes to those styles observable to the user, but not to Javascript.

This is an extremely hard problem, and browsers have had a lot of security issues related to this behavior. Nowadays, you can only apply a very limited subset of CSS properties to those styles, to avoid side-channel timing attacks and such.

This means you can display a banner to anybody who has a certain URL in their browser history, but you can't observe whether that banner actually shows up with JS or transmit that information to your server.

Replies

mananaysiempre • 10/10/2024

Ah. Ahhh[1]. I see.

  <!doctype html>
  <style>a { color: white; background-color: white; } a:visited { color: black; }</style>
  <body><a href="https://example.com/abracadabra" onclick="return false">you are a bad person</a>
[1] https://developer.mozilla.org/en-US/docs/Web/CSS/:visited#pr...
Wowfunhappy • 10/10/2024

> This means you can display a banner to anybody who has a certain URL in their browser history, but you can't observe whether that banner actually shows up with JS or transmit that information to your server.

How do they stop you from using Canvas to see the output and send it back?

➕ show 1 reply