Question

This is a follow up to my original question here. The answers proposed work in Firefox, but there are problems with at least Chrome and Safari (on iOS).

The initial issue is this: on an unrelated site (say Facebook), users can create links where the href is in the form http//www.siteA.com/?http://www.siteB.com. The intention is that siteA parses the querystring and re-directs the browser to siteB. That all works fine.

Then, when a user, having been re-directed to siteB, clicks the back button on their browser, the goal is that they should return to siteA and not be re-directed again.

The answer to my previous question proposed that at the time of the re-direction from siteA, the code on siteA checks for a cookie - if it is not there, it sets it and re-directs. If it is there, then no redirection. In order to allow the user to return to the original referring page and click the same link again (and be re-directed to siteB), it was also proposed that if the cookie is found on siteA, as well as no re-direction, the cookie is deleted.

On Firefox that all works. The 2 problems now are:

  1. on Chrome (and maybe others), the cookie deletion either doesn't work, or works only after the user navigates to another site. The deletion code is just simple javascript, setting the same cookie with an expiry date in the past. This may in practice be a relatively minor issue, but it would be nice to find a solution.
  2. on Safari on iOS, siteA is not in the browser history. It seems iOS (and maybe Safari generally), tries to avoid the looping problem) of returning to a page that re-directed to a second site), by omitting the re-directing page from the history stack. As a result, the pressing the back button on siteB goes to the page prior to the re-directing page. This is a major issue.

It seems there are 3 possibilities - what I want to do is not possible because it's a security risk; there's no crosss-browser/platform solution; or I've approached the goal by completely the wrong method.

The fixed points are:

  1. the form of the URL (with a querystring containing the second URL);
  2. no access to the server (limited to javascript/jquery).
  3. no control over siteB (only siteA).

I'd be grateful for any suggestions and/or advice.

Thanks

Was it helpful?

Solution

This appears to be a solution to issue 2:

$(document).ready(function() {
  var s = location.search;
   if(s != '') {
    var split = s.split('?');
     var loc = split[1].replace('?', '');
      if (document.cookie.indexOf('redirected=' + loc + '') == -1) {
           document.cookie = 'redirected=' + loc + '';
           var link = document.createElement('a');
           link.href = loc;
           document.body.appendChild(link);
           link.click();
          } else {
           document.cookie = 'redirected=' + loc + '; expires=Thu, 01 Jan 1970 00:00:00 GMT';
           var url = location.href.replace('' + s + '', '');
           location.href = '' + url + '';
          }
          } else
          {
          //do something on the re-direction page
          }
          });

It's a bit old school, but instead of re-directing, you create a link on the intermediate page and click it programmatically. That works like a re-direction, but leaves the re-directing page in the history stack, even on iOS.

Thanks to this answer on SO for the hint.

Still looking for a way to remove the cookie more effectively though.

I'd be interested and grateful to read any other comments on these issues. Thanks.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top