Issues with :visited state on links without protocol

[d4rkr00t]

Summary:

URLs without protocol would not get :visited state ever in some browsers.

<a href="//medium.com">medium.com</a>

Platforms:

iOS Safari 7 - 9 Android Opera <= 32  

Reduced Example:

http://codepen.io/d4rkr00t/pen/dYRReB

Bug Tracker ticket(s):

• Bug reported to Apple
• Bug reported to Opera

Workarounds:

• Just add protocol (http or https).

[Mouvedia]

That's a security feature. Id close this issue as by design.

[d4rkr00t]

Oh, ok. But could you give me a link or something where I can read about it? Because it looks strange that this issue appears only in safari and opera.

[Mouvedia]

Here's one: https://blog.mozilla.org/security/2010/03/31/plugging-the-css-history-leak/

Concerning this issue it's probably even more specific cause it gives the hacker a way to check either protocol with only one test.

[d4rkr00t]

Thank you! I'll read this post.