CODEWITHSUNDEEP
javascriptsecurity
Богуслав Павлишинець
Богуслав Павлишинець

Reputation: 1105

"SecurityError: The operation is insecure." pushing history in browser js

When I push history to browser in the next way:

window.history.pushState(
          {
            some_safe_data: data
          },
          'some secure title',
          '//' + translation + '/' + book + '/' + chapter + '/'
        )

It say me SecurityError: The operation is insecure. The problem is in '//'. When I try to push the url with one slash -- It works. When I add a new one -- it gives me an error.

Why two slashes is not secure?

Upvotes: 1

Views: 3405

Answers (1)

vonschlager
vonschlager

Reputation: 324

When you use single '/' you append to the current domain, when you use double '/' you are replacing current domain name with 'translation' and that is not allowed because of the same origin policy.

The new URL can be any URL in the same origin as the current URL. In contrast, setting window.location keeps you at the same document only if you modify only the hash.

pushState mozilla docs

Upvotes: 3

Related Questions