nextwebgen.com

Chris Blizzard has done a nice roundup of David Baron’s post, the bug and the post on the security blog which discusses the :visited issue.

We have seen :visited sniffing for good as well as ill (Aza wrote about using it to detect what networks you are on which can help you put up the right badge in an OpenID signup say) but it is a loophole that many want to fix.

The fix could affect you though. Here is what is changing:

These changes will have some impact on web sites and developers, so you should be aware of them. At a high level here’s what’s changing:

• getComputedStyle (and similar functions like querySelector) will lie. They will always return values as if a user has never visited a site.
• You will still be able to visually style visited links, but you’re severely limited in what you can use. We’re limiting the CSS properties that can be used to style visited links to color, background-color, border-*-color, and outline-color and the color parts of the fill and stroke properties. For any other parts of the style for visited links, the style for unvisited links is used instead. In addition, for the list of properties you can change above, you won’t be able to set rgba() or hsla() colors or transparent on them.

These are pretty obvious cases that are used widely. There are a couple of subtle changes to how selectors work as well:

• If you use a sibling selector (combinator) like :visited + span then the span will be styled as if the link were unvisited.
• If you’re using nested link elements (rare) and the element being matched is different than the link whose presence in history is being tested, then the element will be drawn as if the link were unvisited as well.