85374 2012-05-02 07:42:30 -0700 http "referer" header not properly set when using HTML5 pushState 2012-05-07 02:06:14 -0700 1 1 1 Unclassified WebKit History 528+ (Nightly build) Mac (Intel) OS X 10.7 RESOLVED FIXED P2 Major --- 1 milovan.zogovic jochen abarth ap beidson eric fishd japhet jochen milovan.zogovic webkit.review.bot oldest_to_newest 614294 0 milovan.zogovic 2012-05-02 07:42:30 -0700 Given I am on "bar.html", and I run following javascript: history.pushState( {}, "page1", "foo.html"); history.back(); // going back to "bar.html" location.href = "fuffy.html"; The fuffy.html will be requested with "referer: foo.html" header, even though request is originating from "bar.html". 614295 1 milovan.zogovic 2012-05-02 07:43:43 -0700 If you use the browser's back button (instead history.back()), the outcome is the same. 614427 2 eric 2012-05-02 10:47:54 -0700 Nifty. 614687 3 jochen 2012-05-02 14:45:27 -0700 looks like history.back() doesn't properly update FrameLoader::m_outgoingReferrer 616122 4 140201 jochen 2012-05-04 06:07:02 -0700 Created attachment 140201 Patch 616316 5 140201 webkit.review.bot 2012-05-04 09:42:20 -0700 Comment on attachment 140201 Patch Clearing flags on attachment: 140201 Committed r116113: <http://trac.webkit.org/changeset/116113> 616317 6 webkit.review.bot 2012-05-04 09:42:25 -0700 All reviewed patches have been landed. Closing bug. 616910 7 milovan.zogovic 2012-05-05 00:16:20 -0700 I'm total newb and this was my first bug report.. so i have no clue what is going on here :) Is there any js snippet that I can inject to make this work for older webkit browsers? I use this feature in production and this bug makes it impossible. I'd need to manually pass referrer everywhere.. 616942 8 jochen 2012-05-05 04:45:07 -0700 I think history.replaceState(history.state, "", ""); after the popstate event triggered by history.back(); should set the correct referrer on older webkits, but I haven't tried it. 617466 9 milovan.zogovic 2012-05-07 02:06:14 -0700 I've tried it.. but unfortunately it doesn't work :( Any other ideas? (In reply to comment #8) > I think history.replaceState(history.state, "", ""); after the popstate event triggered by history.back(); should set the correct referrer on older webkits, but I haven't tried it. 140201 2012-05-04 06:07:02 -0700 2012-05-04 09:42:20 -0700 Patch bug-85374-20120504150701.patch text/plain 5134 jochen U3VidmVyc2lvbiBSZXZpc2lvbjogMTE1ODQxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMTZjNzA2MWMyYzZmYTMx YjZmMTkwMjAzYjY5MmY2NTkzZWY2MDZlNS4uNzI0ZDY5MmQ0ZjI2Y2YzNzE0MDlhYTEzZDk1OWNl YWIwMDkwZTE0OSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDEyLTA1LTA0ICBKb2No ZW4gRWlzaW5nZXIgIDxqb2NoZW5AY2hyb21pdW0ub3JnPgorCisgICAgICAgIENvcnJlY3RseSB1 cGRhdGUgdGhlIG91dGdvaW5nIHJlZmVycmVyIHdoZW4gbmF2aWdhdGluZyBiYWNrIGZyb20gYW4g aGlzdG9yeSBpdGVtIGNyZWF0ZWQgYnkgcHVzaFN0YXRlL3JlcGxhY2VTdGF0ZQorICAgICAgICBo dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9ODUzNzQKKworICAgICAgICBS ZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUZXN0OiBodHRwL3Rlc3RzL2hp c3RvcnkvaGlzdG9yeS1uYXZpZ2F0aW9ucy1zZXQtcmVmZXJyZXIuaHRtbAorCisgICAgICAgICog bG9hZGVyL0ZyYW1lTG9hZGVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkZyYW1lTG9hZGVyOjps b2FkSW5TYW1lRG9jdW1lbnQpOgorCiAyMDEyLTA1LTAyICBObydhbSBSb3NlbnRoYWwgIDxub2Ft LnJvc2VudGhhbEBub2tpYS5jb20+CiAKICAgICAgICAgW1RleG1hcF0gRW5hYmxlIGNzcyBmaWx0 ZXJzIGluIFRleHR1cmVNYXBwZXJHTApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvbG9hZGVy L0ZyYW1lTG9hZGVyLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9GcmFtZUxvYWRlci5jcHAK aW5kZXggOGNhYTVhYzdkZGIzZmE4YWZkNzIyYjZiZDc1NWQyYjY1ZjY2MzJjOS4uMzI2OGE0Zjc5 ZDI0OWE2MmEyMGJlZjMyOTM1NDU1Yzg4OGIzODFlYSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNv cmUvbG9hZGVyL0ZyYW1lTG9hZGVyLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvRnJh bWVMb2FkZXIuY3BwCkBAIC05ODAsNiArOTgwLDcgQEAgdm9pZCBGcmFtZUxvYWRlcjo6bG9hZElu U2FtZURvY3VtZW50KGNvbnN0IEtVUkwmIHVybCwgU2VyaWFsaXplZFNjcmlwdFZhbHVlKiBzdGEK ICAgICAvLyBVcGRhdGUgdGhlIGRhdGEgc291cmNlJ3MgcmVxdWVzdCB3aXRoIHRoZSBuZXcgVVJM IHRvIGZha2UgdGhlIFVSTCBjaGFuZ2UKICAgICBLVVJMIG9sZFVSTCA9IG1fZnJhbWUtPmRvY3Vt ZW50KCktPnVybCgpOwogICAgIG1fZnJhbWUtPmRvY3VtZW50KCktPnNldFVSTCh1cmwpOworICAg IHNldE91dGdvaW5nUmVmZXJyZXIodXJsKTsKICAgICBkb2N1bWVudExvYWRlcigpLT5yZXBsYWNl UmVxdWVzdFVSTEZvclNhbWVEb2N1bWVudE5hdmlnYXRpb24odXJsKTsKICAgICBpZiAoaXNOZXdO YXZpZ2F0aW9uICYmICFzaG91bGRUcmVhdFVSTEFzU2FtZUFzQ3VycmVudCh1cmwpICYmICFzdGF0 ZU9iamVjdCkgewogICAgICAgICAvLyBOQjogbXVzdCBoYXBwZW4gYWZ0ZXIgcmVwbGFjZVJlcXVl c3RVUkxGb3JTYW1lRG9jdW1lbnROYXZpZ2F0aW9uKCksIHNpbmNlIHdlIGFkZCAKZGlmZiAtLWdp dCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCAz OTAyYWYyYmQwNjcyOThlOTQ1MjZkZWFmMTYyNGNlNWZiMDkwNGJiLi4wOWU0OTYwNDhiMTFlYTNm ZmMyYTYwMjAzYWM4OGU0MjUyNTlhMWViIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTItMDUt MDQgIEpvY2hlbiBFaXNpbmdlciAgPGpvY2hlbkBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgQ29y cmVjdGx5IHVwZGF0ZSB0aGUgb3V0Z29pbmcgcmVmZXJyZXIgd2hlbiBuYXZpZ2F0aW5nIGJhY2sg ZnJvbSBhbiBoaXN0b3J5IGl0ZW0gY3JlYXRlZCBieSBwdXNoU3RhdGUvcmVwbGFjZVN0YXRlCisg ICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD04NTM3NAorCisg ICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogaHR0cC90ZXN0 cy9oaXN0b3J5L2hpc3RvcnktbmF2aWdhdGlvbnMtc2V0LXJlZmVycmVyLWV4cGVjdGVkLnR4dDog QWRkZWQuCisgICAgICAgICogaHR0cC90ZXN0cy9oaXN0b3J5L2hpc3RvcnktbmF2aWdhdGlvbnMt c2V0LXJlZmVycmVyLmh0bWw6IEFkZGVkLgorICAgICAgICAqIGh0dHAvdGVzdHMvaGlzdG9yeS9y ZXNvdXJjZXMvY2hlY2stcmVmZXJyZXIuaHRtbDogQWRkZWQuCisKIDIwMTItMDUtMDIgIEFuZHJl eSBLb3N5YWtvdiAgPGNhc2VxQGNocm9taXVtLm9yZz4KIAogICAgICAgICBVbnJldmlld2VkLiBS ZWZpbmluZyBleHBlY3RhdGlvbnMgZm9yIHBhc3NpbmcgdGVzdHMuCmRpZmYgLS1naXQgYS9MYXlv dXRUZXN0cy9odHRwL3Rlc3RzL2hpc3RvcnkvaGlzdG9yeS1uYXZpZ2F0aW9ucy1zZXQtcmVmZXJy ZXItZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9oaXN0b3J5L2hpc3Rvcnkt bmF2aWdhdGlvbnMtc2V0LXJlZmVycmVyLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0 NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi41MDUzZjIw OGVkMmU3MzdhYjE5YTQzYTA5MzJjOGUyMmI5MTk3MjFjCi0tLSAvZGV2L251bGwKKysrIGIvTGF5 b3V0VGVzdHMvaHR0cC90ZXN0cy9oaXN0b3J5L2hpc3RvcnktbmF2aWdhdGlvbnMtc2V0LXJlZmVy cmVyLWV4cGVjdGVkLnR4dApAQCAtMCwwICsxLDQgQEAKK1Rlc3RzIHRoYXQgd2hlbiBuYXZpZ2F0 aW5nIGJhY2sgZnJvbSBhIGhpc3RvcnkgZW50cnkgdGhhdCB3YXMgY3JlYXRlZCBieSBoaXN0b3J5 LnB1c2hTdGF0ZSgpLCB0aGUgb3V0Z29pbmcgcmVmZXJyZXIgaXMgY29ycmVjdGx5IHVwZGF0ZWQu CisKK1BBU1M6IGNvcnJlY3QgcmVmZXJyZXIgc2VuZAorCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0 cy9odHRwL3Rlc3RzL2hpc3RvcnkvaGlzdG9yeS1uYXZpZ2F0aW9ucy1zZXQtcmVmZXJyZXIuaHRt bCBiL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvaGlzdG9yeS9oaXN0b3J5LW5hdmlnYXRpb25zLXNl dC1yZWZlcnJlci5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLjQ0MDQ2ODBhZDNkMDQwZTk0YzQ0OGI3NzU5YTAy NTMyMjFlNWRiNjgKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL2hp c3RvcnkvaGlzdG9yeS1uYXZpZ2F0aW9ucy1zZXQtcmVmZXJyZXIuaHRtbApAQCAtMCwwICsxLDMy IEBACis8IURPQ1RZUEUgaHRtbD4KKzxodG1sPgorPGhlYWQ+Cis8c2NyaXB0PgoraWYgKHdpbmRv dy5sYXlvdXRUZXN0Q29udHJvbGxlcikgeworICAgIGxheW91dFRlc3RDb250cm9sbGVyLndhaXRV bnRpbERvbmUoKTsKKyAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7Cit9CisK K2Z1bmN0aW9uIHRlc3QoKSB7CisgICAgaGlzdG9yeS5yZXBsYWNlU3RhdGUoImluaXRpYWxTdGF0 ZSIsICIiLCAiIik7CisgICAgaGlzdG9yeS5wdXNoU3RhdGUoIiIsICIiLCAib3RoZXIuaHRtbCIp OworICAgIGhpc3RvcnkuYmFjaygpOworfQorCitvbnBvcHN0YXRlID0gZnVuY3Rpb24gKGV2dCkg eworICAgIGlmIChldnQuc3RhdGUgPT0gImluaXRpYWxTdGF0ZSIpCisgICAgICAgIGxvY2F0aW9u LmhyZWYgPSAicmVzb3VyY2VzL2NoZWNrLXJlZmVycmVyLmh0bWwiOworfQorPC9zY3JpcHQ+Cis8 L2hlYWQ+Cis8Ym9keSBvbmxvYWQ9InRlc3QoKSI+Cis8cD4KK1Rlc3RzIHRoYXQgd2hlbiBuYXZp Z2F0aW5nIGJhY2sgZnJvbSBhIGhpc3RvcnkgZW50cnkgdGhhdCB3YXMgY3JlYXRlZCBieQoraGlz dG9yeS5wdXNoU3RhdGUoKSwgdGhlIG91dGdvaW5nIHJlZmVycmVyIGlzIGNvcnJlY3RseSB1cGRh dGVkLgorPC9wPgorPGRpdj4KK0ZBSUw6IHBvcHN0YXRlIGV2ZW50IHdhcyBuZXZlciByZWNlaXZl ZAorPC9kaXY+Cis8L2JvZHk+Cis8L2h0bWw+CisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2h0 dHAvdGVzdHMvaGlzdG9yeS9yZXNvdXJjZXMvY2hlY2stcmVmZXJyZXIuaHRtbCBiL0xheW91dFRl c3RzL2h0dHAvdGVzdHMvaGlzdG9yeS9yZXNvdXJjZXMvY2hlY2stcmVmZXJyZXIuaHRtbApuZXcg ZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwLi45M2I3OWMzOWM4OTk2ZjU3NGU3OThkN2IxN2RjYTllZTY4ZDRlYWFkCi0tLSAvZGV2 L251bGwKKysrIGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9oaXN0b3J5L3Jlc291cmNlcy9jaGVj ay1yZWZlcnJlci5odG1sCkBAIC0wLDAgKzEsMjcgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+ Cis8aGVhZD4KKzxzY3JpcHQ+CitmdW5jdGlvbiBsb2cobXNnKSB7CisgICAgZG9jdW1lbnQuZ2V0 RWxlbWVudEJ5SWQoImxvZyIpLmlubmVySFRNTCArPSBtc2cgKyAiPGJyPiI7Cit9CisKK2Z1bmN0 aW9uIGNoZWNrKCkgeworICAgIGlmIChkb2N1bWVudC5yZWZlcnJlci5pbmRleE9mKCJvdGhlci5o dG1sIikgIT0gLTEpCisgICAgICAgIGxvZygiRkFJTDogaW5jb3JyZWN0IHJlZmVycmVyIHNlbmQ6 ICIgKyBkb2N1bWVudC5yZWZlcnJlcik7CisgICAgZWxzZQorICAgICAgICBsb2coIlBBU1M6IGNv cnJlY3QgcmVmZXJyZXIgc2VuZCIpOworCisgICAgaWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJv bGxlcikKKyAgICAgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIubm90aWZ5RG9uZSgpOworfQorPC9z Y3JpcHQ+Cis8L2hlYWQ+Cis8Ym9keSBvbmxvYWQ9ImNoZWNrKCkiPgorPHA+CitUZXN0cyB0aGF0 IHdoZW4gbmF2aWdhdGluZyBiYWNrIGZyb20gYSBoaXN0b3J5IGVudHJ5IHRoYXQgd2FzIGNyZWF0 ZWQgYnkKK2hpc3RvcnkucHVzaFN0YXRlKCksIHRoZSBvdXRnb2luZyByZWZlcnJlciBpcyBjb3Jy ZWN0bHkgdXBkYXRlZC4KKzwvcD4KKzxkaXYgaWQ9ImxvZyI+PC9kaXY+Cis8L2JvZHk+Cis8L2h0 bWw+Cg==