SecurityError: The operation is insecure - window.history.pushState()

javascript html url history pushstate
Atadj picture Atadj · Nov 12, 2012 · Viewed 141.5k times · Source

I'm getting this error in Firefox's Console: SecurityError: The operation is insecure and the guilty is HTML5 feature: window.history.pushState() when I try to load something with AJAX. It is supposed to load some data but Javascript stops executing on error.

I'm wondering why this may be happening. Is this some server misconfiguration? Any help would be appreciated.

UPDATE: Yes, it was a server error with domain name not matching: http://en.wikipedia.org/wiki/Same-origin_policy

Answer

Matt picture Matt · Nov 12, 2012

Make sure you are following the Same Origin Policy. This means same domain, same subdomain, same protocol (http vs https) and same port.

How does pushState protect against potential content forgeries?

EDIT: As @robertc aptly pointed out in his comment, some browsers actually implement slightly different security policies when the origin is file:///. Not to mention you can encounter problems when testing locally with file:/// when the page expects it is running from a different origin (and so your pushState assumes production origin scenarios, not localhost scenarios)

Related questions

How do I modify the URL without reloading the page?

Is there a way I can modify the URL of the current page without reloading the page? I would like to access the portion before the # hash if possible. I only need to change the portion after the domain, so …

Read More
Is there any way to specify a suggested filename when using data: URI?

If for example you follow the link: data:application/octet-stream;base64,SGVsbG8= The browser will prompt you to download a file consisting of the data held as base64 in the hyperlink itself. Is there any way of suggesting a default …

Read More
How can I remove the query string from the url after the page loads?

I have a URL with a long query string attached to it. After the page loads, I do not require the query string. So I want to remove the query string from the address bar without a page reload. I …

Read More