Earlier quoted context omitted.
> How do you distinguish example.edu/financial-aid/ from example.edu/~some-student/ That's an unrealistic example because no website worth its salt is going to let students put arbitrary content in the same domain as the financial aid system. That's a recipe for leaking cookies that contain session tokens, and displaying a full URL won't save a user. By the time you see the ~some-student in the URL bar, the security…
You're making a lot of assumptions there. It could be that example.edu/financial-aid/ is just information and PDFs and doesn't have any sessions or cookies. Or the real financial aid system is on another domain, but a first time user doesn't know that, they're just looking at www.example.edu/~some-student/ which appears to be a financial aid page that Chrome only says is example.edu . Or any other case where the cont…
The other scenario you describe, if the risk is someone intentionally deceiving users by cloning a page on the university network owned by someone else for deceptive purposes, is better solved by a university disciplinary hearing than by expecting every student to understand URL paths.