8

I am using a userscript for Chrome and Firefox and I am checking for links that have been visited by the user. I have 

a{
   color: blue;
}

a:visited{
   color: red !important;
}

in my css imported as soon as the page loads. The a-links on the page that I have visited are colored red instead of default of blue. I then use:

alert(window.getComputedStyle(document.getElementById("myLink"), null).getPropertyValue("color"))

on each link and they all return red for the visited links in Firefox but in Chrome they all return blue.

I was wondering how to implement finding visited links using javascript with Chrome. Jquery code or normal javascript code is fine. Thanks in advance.

user654628
  • 1,429
  • 1
  • 17
  • 37
  • 1
    I thought this privacy bug has long been fixed in Firefox, so it shouldn't work there: http://blog.mozilla.com/security/2010/03/31/plugging-the-css-history-leak/ –  Mar 22 '11 at 16:11
  • Ok I see, I tried setting layout.css.visited_links_enabled to false in Firefox and links don't change color. So this means that there is absolutely no way to check if the user has visited the page before? – user654628 Mar 22 '11 at 23:28

1 Answers1

12

A_horse_with_no_name is right. The :visited security issue was fixed in 2010 by the browser vendors, after a nifty demo (Spyjax; no longer up) demonstrated that any webpage could discover whether you've visited any given URL. You can verify that getComputedStyle on a link no longer returns the :visited color--even within the same domain:

// Test I used within the JS console.
// :visited is no longer detectable by getComputedStyle.
function getLinkColor(url) {
  var a = document.createElement('a');
  a.href = a.textContent = url;
  document.body.appendChild(a);
  return document.defaultView.getComputedStyle(a, null).color;
}
getLinkColor('http://stackoverflow.com/questions/5394099/detect-visited-link-in-chrome');
getLinkColor('http://stackoverflow.com/some-fake-path');

For Chrome extensions, if you want to detect whether a user has visited a URL, I think you'll have to request the "history" permission and call chrome.history.getVisits.

yonran
  • 18,156
  • 8
  • 72
  • 97
  • So I am using a userscript, I cannot edit to the manifest file, so does this mean I cannot gain access to history? I am using a userscript to be crossbrowser for my script to run on Firefox and Chrome. Another thing is that visually you can see the change for visited links (on Chrome, some links are blue and some are red) but the javascript detects them all as blue. – user654628 Mar 22 '11 at 23:18
  • That's right. Even though the user sees a different color for :visited, the browser hides this information from Javascript for security reasons. You need to use the browser-specific history APIs. – yonran Mar 23 '11 at 23:53
  • Thanks, I have decided to do a different approach to the problem. I have decided to store most of the visited links (after click event) in localStorage (not the entire url and just for one domain). – user654628 Mar 24 '11 at 06:12
  • FYI, getComputedStyle is still vulnerable as per http://privacylog.blogspot.com/2010/08/mozillas-css-visited-solution-is-still.html – William Entriken Feb 13 '12 at 02:17
  • @FullDecent: Hi! I know this was 4 years ago, but is getComputedStyle still vulnerable in Firefox? I tried your link, but nothing there seems to indicate that I have visited purple.com before. In other words, I'm not sure I understand what that link is supposed to do. – Cerberus May 21 '16 at 15:00