Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

After reading the question about referrer and the answer of @D.W., I did not understand the following part:

XSS defense. Strict referer checking can make reflective XSS attacks harder, because other sites can't trick the victim's browser into visiting the vulnerable URL.

I did not get it. So if on my site I implemented the referrer checker and it redirects me to a specific page if I am coming from anything else outside of my site, how does it helps me with XSS attacks.

May be I misunderstood something, and also sorry if it is obvious for someone.

share|improve this question
    
Btw, does the @D.W. in the question works like the @ in comments (a ping to his inbox)? –  Pacerier Jun 6 at 19:32

5 Answers 5

up vote 4 down vote accepted

Many of the cross-site request forgery countermeasures will make reflective XSS more difficult to exploit but not impossible. It may still be possible to exploit one of these flaws with clickjacking or other methods. Clickjacking and other vectors should also be fixed, but its not a simple or foolproof solution when compared to input validation/sanitation.

There are problems with the referer header as a security measure. If the request originates from an HTTPS page going to an HTTP page then Referer will be absent. The origin header was created to address this issue. An OWASP A10: Unvalidated redirects and forwards could also be used to bypass a referer check.

share|improve this answer
3  
+1. Either you block null-referer and break a number of legitimate cases, or you don't block it and you can be hit by the various means of referrer-hiding. Summary: Referer-checking is not a good defence against XSS (or really, on its own, anything much). –  bobince Nov 23 '12 at 10:31

Note: I'll make an answer since the current accepted answer didn't actually answer the question.

Reflective XSS basically involves tricking a victim to click a link to your website:

  • An attacker can email a victim the link your-website.com/query?<script>alert('hacked!');evil();</script>

  • evil.com can link to your-website.com/query?<script>alert('hacked!');evil();</script> and trick a victim into clicking it.

If your website does strict referrer checking, it will reject requests like those above.

Of course, if your website allows users to post links, then an attacker can post the link your-website.com/query?<script>alert('hacked!');evil();</script> under your website. Strict referrer checking will then fail, since the referrer is your own website.

share|improve this answer

Referer protection isn't fool proof if you have other vulnerabilities on the site.

If you have an open redirect on your site (or even one with checks to see if the link is internal), we can place the vulnerable URL into this redirect, and the users gets sent to the vulnerable page with a correct (internal) referer.

share|improve this answer
    
+1 Good point on the internal redirect.... –  Pacerier Jun 6 at 16:39

Referer checking will help with some classes of XSS - reflected XSS and DOM XSS but will have no effect on stored XSS.

share|improve this answer
    
‘Can help’, not ‘will help’. The client doesn’t have to send any Referer at all. –  Gumbo Nov 23 '12 at 18:49
    
@Gumbo, read the original context, where it referred to strict referer checking (which means that if the request has no Referer header, the request is denied). P.S. I agree that even then, it's a 'can help', not 'will help'. –  D.W. Nov 24 '12 at 1:48
    
@D.W., Why do you say 'can help'? It will help some kinds of XSS attacks, not "can help". –  Pacerier Jun 8 at 14:05
    
@Pacerier, because it depends on other factors. There may still be ways to exploit some XSS vulnerabilities, even if strict Referer checking is in place. (e.g., if there's a redirector on the same site; if user content is allowed on the site; if loose Referer checking is used rather than strict Referer header). Also there is no guarantee that Referer checking will help with DOM-based XSS, contrary to what this answer might tend to suggest. –  D.W. Jun 8 at 21:17
    
@D.W., Yes I undestand that point. So it will help some kinds of XSS attacks, and it will not help other kinds of XSS attacks. –  Pacerier Jun 9 at 12:48

I think, it's actually quite simple: since the page, you are being redirected to, only accepts referrers from your own site (that is: domain), XSS is harder (only one site allowed).

But that would have the downside that you cannot access that page from the outside, only the referrer - making readability of url's for example quite complicated (but the downsides are quite well explained by D.W.).

an example: say you have a blog. direct access to blog/post/id/12 isn't allowed (referrer checker), but access to the perma-link of the post (blog/post/perm/12) is allowed. The perma-link only serves you the referrer, the referrer redirects to the post (blog/post/id/12) - et voila!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.