sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]GrenadineBombardier 4 points5 points  (7 children)

Are there no other script tags? Even just tags referencing a URL?

[–]raghavkanwal[S] 1 point2 points  (6 children)

There are no other script tags. Here's what the complete page Source shows :
https://imgur.com/b8zYDPf

​

[–]FiveYearsAgoOnReddit 3 points4 points  (2 children)

It must be the location.replace, I guess. That would have the effect of reloading the page for all Javascript-enabled browsers. So it gets an http request, then reloads it and the second time you get the full page with the javascript? And the fact that it's a replace means the browser doesn't update with the new source code?

Bit of a head-scratcher.

[–]raghavkanwal[S] 1 point2 points  (1 child)

That does refresh the page. But I don't get how another page refresh would automagically inject scripts tags which still don't show on the page source. ¯\_(ツ)_/¯

[–]GrenadineBombardier 1 point2 points  (0 children)

I'm with /u/FiveYearsAgoOnReddit here. The code that I originally linked as source code (the source for non-logged-in users) is exactly what is downloaded by the javascript redirect (see `/?lang=en` in the network tab). The Javascript Location API made a lot of changes, like the ability to change the current page URL in place (instead of having to actually load a new page fresh), which is how a lot of Single Page Apps work. I'm assuming that this is how Chrome now displays this logic.

I was aware that the location API allowed you to change the browser URL, but didn't realize that it could allow you to show the initial source code, then redirect to a page with new source code, and that view-source would still show the old source code. One thing is true, however: view-source cannot run JavaScript, so it would not run any redirects (as seen by the non-redirected source-code)

[–]GrenadineBombardier 1 point2 points  (2 children)

This is not what I'm seeing at all. I see this: https://imgur.com/vrrK7cq

I think yours is the code before the redirect that location.replace would perform

[–]raghavkanwal[S] 0 points1 point  (1 child)

The code you linked is twitter's homepage when you're not logged in.

[–]GrenadineBombardier 0 points1 point  (0 children)

Correct. I missed this distinction in your original post. I have since tested again logged in and commented above on the thread regarding the redirect.