Question

I am writing a Greasemonkey userscript, for a site which has two domains. Let’s say http://friendlyurl.com and http://ugly.url.com. http://friendlyurl.com/* redirects to http://ugly.url.com/*.
One of the features I wanted to include in the userscript was rewriting the ugly URL to the friendly one using HTML5 replaceState().

The code I had was:

(function() {
    if (history.replaceState) {
        var url = document.location.href.replace('ugly.url.com/', 'friendlyurl.com/');
        history.replaceState({}, document.title, url);
    }
})();

Until I realized this disobeys the Same-Origin policy. My question is: is there a workaround to switch the site’s domain, potentially using the GM_* API? Obviously as this is a userscript the security issue is on a much lower scale.
My current guess is that it is not possible, but I thought I’d put the question out there.

Answer 1

history.replaceState cannnot be used to change the domain, for security reasons. Not even through a GM API.

See more details on the rules in the HTML Standard for replaceState().