1803969 - Give Firefox's back button an intervention to skip over spammy history-entries that were injected using pushState without user interaction (e.g. by spammy news sites)

Status: RESOLVED DUPLICATE of bug 1645211

(Core :: DOM: Navigation, defect)

Description

[Daniel Holbert [:dholbert]]

STR:

1. Click a link to a news article on Daily Kos or SFGate, e.g. this one:
   https://m.dailykos.com/stories/2021/2/11/2015376/-Yet-another-thorough-take-down-of-serial-fabricator-Seth-Abramson
2. Wait 5 seconds
3. Navigate back with e.g. alt+leftarrow

EXPECTED RESULTS:
You should return to the page you came from.

ACTUAL RESULTS:
You end up on a page that the news site seems to have inserted (possibly via History.pushState or somesuch?) which says "More stories to check out before you go".

For comparison: Chrome gives EXPECTED RESULTS. They do show the injected page in their backarrow-button's dropdown menu, but they don't seem to actually visit it on back navigations; they only visit it if you explicitly choose it from the button's dropdown menu.

Firefox Nightly reproduces this, on Android as well as Desktop, but I seem to notice this issue most often on Android -- when I visit a news site from e.g. a link in Twitter or the Google app (with its selection of suggested news articles/stories), I get a Firefox "app tab" showing the article, and I expect the "back" Android-gesture to return me to where I came from. But instead it takes me to this splash page, if I happen to be viewing an article on e.g. dailykos or sfgate or another similar site.

Comment 1

[Daniel Holbert [:dholbert]]

Actually -- one interesting quirk in Chrome.

If I click and hold the back-navigation arrow-button in Chrome, to inspect the list of back-navigation targets, and then let that menu disappear, and then navigate back (via either Alt+Leftarrow or clicking back), then I do hit the injected splash page there. So it looks like they inject the splash page into the bfcache list, but they skip over it unless you manually inspect the list... or something like that?

Comment 2

[Daniel Holbert [:dholbert]]

Attachment: testcase 1 (reduced): calls pushState 5x at pageload

Here's a reduced testcase.

If you click the testcase's link here on this bug page, and then press the back button, orAlt+LeftArrowKey on my keyboard, Chrome will successfully navigate back to this Bugzilla page; whereas Firefox gets blocked by the pushState entries (and you have to navigate back 5 times before it actually goes back).

Comment 3

[Daniel Holbert [:dholbert]]

Without knowing too much about the details here, I would bet that Firefox's behavior is technically spec-compliant, but Chrome's behavior is useful as an intervention, similar to pop-up blockers, e.g. suppressing/flagging pushState calls that happen in the background without user interaction.

Comment 4

[Daniel Holbert [:dholbert]]

Indeed, it looks like this intervention is discussed here on github -- I think this is the most recent spec discussion about this:
https://github.com/whatwg/html/issues/7832

I found some older discussions about this as well, from when Chrome folks proposed/shipped this:
https://github.com/whatwg/html/issues/3524
https://github.com/WICG/interventions/issues/21
https://groups.google.com/a/chromium.org/g/blink-dev/c/OCS7g72HtyI

Comment 5

[Daniel Holbert [:dholbert]]

It looks like maybe we have a partial implementation?

The first comment on https://github.com/whatwg/html/issues/7832 says...

@johannhof has mentioned that reverse-engineering Chromium's logic was a pain for Firefox (and still not shipped)

...which implies that we have an un-shipped impl tracked somewhere. I suppose this bug wants to be duped there.

Comment 6

[Hsin-Yi Tsai (she/her) [:hsinyi]]

(In reply to Daniel Holbert [:dholbert] from comment #5)

It looks like maybe we have a partial implementation?

The first comment on https://github.com/whatwg/html/issues/7832 says...

@johannhof has mentioned that reverse-engineering Chromium's logic was a pain for Firefox (and still not shipped)

...which implies that we have an un-shipped impl tracked somewhere. I suppose this bug wants to be duped there.

Sounds it's this bug https://bugzilla.mozilla.org/show_bug.cgi?id=1734181

Comment 7

[Daniel Holbert [:dholbert]]

Thanks! Really a dupe of meta bug 1645211, I guess.