logoalt Hacker News

skrebbeltoday at 11:42 AM1 replyview on HN

How does this work? How can a site inject a totally different site into the history? I thought eg the History API only lets you add to the stack and pop, not modify history?


Replies

lxgrtoday at 12:01 PM

There's also a replace() method, and trying to limit that to only same origin or already visited URLs seems futile, as the pages hosted there can themselves detect that the user is navigating back and can just forward you in a number of ways.