How does pushState protect against potential content forgeries?
As seen in [GitHub's blog](https://github.com/blog/760-the-tree-slider), they've implemented [HTML5's JavaScript `pushState`](https://developer.mozilla.org/en/DOM/Manipulating_the_browser_history) feature for tree browsing (for modern browsers), bringing AJAX navigation [without Hash Bangs](http://danwebb.net/2011/5/28/it-is-about-the-hashbangs).

The code is simple:

    $('#slider a').click(function() {
      history.pushState({ path: this.path }, '', this.href)
      $.get(this.href, function(data) {
        $('#slider').slideTo(data)
      })
      return false
    })

This quite elegantly allows them to:

1. Request the just the new content through AJAX instead of a full page
2. Animate the transition
3. **And** change the browsers URL *(not just the `#`, as Twitter does &mdash; [twitter.com/stackexchange](http://twitter.com/stackexchange) &rarr; [twitter.com/#!/stackexchange](http://twitter.com/#!/stackexchange) )*

My question is, how does JavaScript prevent against the use of `pushState` by one website to imitate another, resulting in a convincing [phishing attack](http://en.wikipedia.org/wiki/Phishing#Website_forgery)?

At the very least it seems that the domain can't be changed, but what about multiple paths within a site, potentially by multiple unrelated and untrusting content providers?  Could one path (I.E. **/joe**) essentially imitate another (pushState **/jane**) and provide imitative content, with possibly malicious purposes?
How does pushState protect against potential content forgeries?
===

As seen in [GitHub's blog](https://github.com/blog/760-the-tree-slider), they've implemented [HTML5's JavaScript `pushState`](https://developer.mozilla.org/en/DOM/Manipulating_the_browser_history) feature for tree browsing (for modern browsers), bringing AJAX navigation [without Hash Bangs](http://danwebb.net/2011/5/28/it-is-about-the-hashbangs).

The code is simple:

    $('#slider a').click(function() {
      history.pushState({ path: this.path }, '', this.href)
      $.get(this.href, function(data) {
        $('#slider').slideTo(data)
      })
      return false
    })

This quite elegantly allows them to:

1. Request the just the new content through AJAX instead of a full page
2. Animate the transition
3. **And** change the browsers URL *(not just the `#`, as Twitter does &mdash; [twitter.com/stackexchange](http://twitter.com/stackexchange) &rarr; [twitter.com/#!/stackexchange](http://twitter.com/#!/stackexchange) )*

My question is, how does JavaScript prevent against the use of `pushState` by one website to imitate another, resulting in a convincing [phishing attack](http://en.wikipedia.org/wiki/Phishing#Website_forgery)?

At the very least it seems that the domain can't be changed, but what about multiple paths within a site, potentially by multiple unrelated and untrusting content providers?  Could one path (I.E. **/joe**) essentially imitate another (pushState **/jane**) and provide imitative content, with possibly malicious purposes?