I should be able to see that the user visited Amazon.com and Facebook.com before.
No, you can't arbitrarily access the browsing history.
- You can find out how many entries the history has (
- You can navigate back to any of these history entries (e.g.
- You cannot learn what these entries are, neither the domain nor the URL.
in order to manipulate the browsing history, the HTML5-App needs to read the history first.
Well, details of the previous entries exist in memory, but the browser hides them from content scripts. Otherwise, being able to access the history cross-domain would obviously cause massive privacy problems. Just imagine one of the previous sites had a password reset token in the URL.
If it's not true, can you explain to me how exactly this History-API works?
In HTML5 you can manipulate the state of the history stack, e.g. using
history.pushState(). This is particularly useful for websites with lots AJAX interaction that want to change the URL without reloading the entire page.1 But you can only change the URL to paths that belong to the same domain and you can only access the state objects for the current page. You can find additional security considerations in this security review of the API by Mozilla.
(Note that in the past there have been lots of browsing history leak vulnerabilities that could disclose visited URLs through side channels, e.g. by abusing CSS properties. But these attacks aren't directly related to the API.)
1It can also be useful for an attacker who wants to hide reflected XSS in the URL by dynamically changing the path to something less suspicious. That's why back then this extension of the API has been somewhat controversial.