title: How does pushState protect against potential content forgeries?
body: <p>As seen in <a href="https://github.com/blog/760-the-tree-slider" rel="noreferrer">GitHub's blog</a>, they've implemented <a href="https://developer.mozilla.org/en/DOM/Manipulating_the_browser_history" rel="noreferrer">HTML5's JavaScript <code>pushState</code></a> feature for tree browsing (for modern browsers), bringing AJAX navigation <a href="http://danwebb.net/2011/5/28/it-is-about-the-hashbangs" rel="noreferrer">without Hash Bangs</a>.</p>
  
  <p>The code is simple:</p>
  
  <pre><code>$('#slider a').click(function() {
    history.pushState({ path: this.path }, '', this.href)
    $.get(this.href, function(data) {
      $('#slider').slideTo(data)
    })
    return false
  })
  </code></pre>
  
  <p>This quite elegantly allows them to:</p>
  
  <ol>
  <li>Request the just the new content through AJAX instead of a full page</li>
  <li>Animate the transition</li>
  <li><strong>And</strong> change the browsers URL <em>(not just the <code>#</code>, as Twitter does &mdash; <a href="http://twitter.com/stackexchange" rel="noreferrer">twitter.com/stackexchange</a> &rarr; <a href="http://twitter.com/#!/stackexchange" rel="noreferrer">twitter.com/#!/stackexchange</a> )</em></li>
  </ol>
  
  <p>My question is, how does JavaScript prevent against the use of <code>pushState</code> by one website to imitate another, resulting in a convincing <a href="http://en.wikipedia.org/wiki/Phishing#Website_forgery" rel="noreferrer">phishing attack</a>?</p>
  
  <p>At the very least it seems that the domain can't be changed, but what about multiple paths within a site, potentially by multiple unrelated and untrusting content providers?  Could one path (I.E. <strong>/joe</strong>) essentially imitate another (pushState <strong>/jane</strong>) and provide imitative content, with possibly malicious purposes?</p>