187
edits
Firefox 3.6/PushState Security Review: Difference between revisions
Firefox 3.6/PushState Security Review (view source)
Revision as of 17:33, 27 August 2009
, 27 August 2009→Review comments
| Line 56: | Line 56: | ||
* Disallow <tt>user:pass</tt> in pushstate'd URIs. | * Disallow <tt>user:pass</tt> in pushstate'd URIs. | ||
* if the current document was opened with userinfo in its URI ignore that for purposes of comparing against pushState's URL. | * if the current document was opened with userinfo in its URI ignore that for purposes of comparing against pushState's URL. | ||
* Push/replace states to same URI shouldn't count for global history. | |||