I am doing a penetration test on a web application and it is using window.history.back() to go back to the previous page. Is this safe to use?

For example, if I visit google.com and then go to the web application and then press back, it would present me with google.com again. Similarly, if an attacker could somehow simulate this in an iframe (if that gets stored in the window's history) or if the user visits the URL (but that would be pointless) or possibly alter some sort of caching mechanism. What real ways are there to exploit this?

Is this an actual issue or am I overthinking?


You can read about windows.history Mozilla website. Briefly it explains that history.back() is not different than clicking on the back button in your browser I think that you are overthinking about windows.history.back, but not about window.history object itself!.
If I explain in detail it would be out of the topic, however, I can shortly claim that window.history.pushState() or window.history.replaceState() methods are more worth to worry about. The browser history manipulation is possible. You can also check out about it from : Manipulating the browser history

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.