Questions tagged [referer]

Referer is the HTTP request header field that contains the address of the webpage from where the request for a web resource originated.

Filter by
Sorted by
Tagged with
2 votes
1 answer
757 views

CSRF: Signed Double Submit Cookie & 'Referer' validation vs MITM and vulnerable subdomains

I have been researching various techniques for preventing CSRF attacks, such as SOP, SameSite, Secure, Referer validation, and CSRF Tokens, and their potential bypasses. During my research, I ...
Advena's user avatar
  • 129
1 vote
0 answers
755 views

Changing referer value in burp request has no impact on the response

I am testing a request/response of an application using the burp suite and found that changing the Referer value has no effect on the response. The Referer contains the URL along with the unique ID of ...
Supraja's user avatar
  • 23
1 vote
1 answer
763 views

Is it recommended to set Referrer-Policy explicitly when the browsers already has a default policy?

I wanted to explicitly define the referrer-policy as "strict-origin-when-cross-origin" in my web application. However, "strict-origin-when-cross-origin" is the browser's default ...
Testers Logic's user avatar
0 votes
1 answer
162 views

How do applications which are integrated using a javascript client side sdk, secure their data or disallow spam?

Take an example of google maps. google maps provides a javascript client SDK, which means any web app running javascript can access the google maps sdk. You need to use an API_KEY so that google can ...
gaurav5430's user avatar
6 votes
1 answer
2k views

using rel="noreferer" without rel="noopener" or without target="_blank"

I have been reading about the security and performance implications of rel="noopener" and rel="noreferrer" in links with target="_blank". These are some of the ...
gaurav5430's user avatar
1 vote
2 answers
245 views

How some sites prevent cross-site requests through referrer although there are redirections allowed

I read about referrer header that some sites use to allow only requests made by the pages of the site. So if I make a page hacker.com, and let this page make a request to https://twitter.com/i/flow/...
zyydoosh's user avatar
  • 123
1 vote
1 answer
293 views

Why did browser authors not make 127.0.0.1/localhost-hosted webpages skip the referrer?

For a long time, I was so convinced that 127.0.0.1/localhost-hosted webpages, that is, with URLs such as: http://127.0.0.1/MySecretControlPanel/sensitive.php?stuff=goes&here=dude ... did not ...
Solace's user avatar
  • 11
3 votes
1 answer
663 views

Retrieving CSRF token from third party website form using XHR (JavaScript)

I know they say CSRF tokens are the most secure way to prevent CSRF attacks but what if someone uses XHR to retrieve the page containing the csrf token along with the form and then use that token for ...
rez's user avatar
  • 133
1 vote
1 answer
559 views

If an application has an XSS vulnerabilty, can we bypass CSRF with referer header?

Let's say there is an XSS vulnerability in an application, and the application is not using any kind of CSRF token, just using the referer header to protect against CSRF. Referer header is validating ...
ZeroNullByte's user avatar
2 votes
1 answer
2k views

Is there any way to pretend like we are routing our request via cloudflare? [closed]

There is this Web App which uses cloudflare and to bypass certain things I had to find a way to access the actual web server directly. I tried numerous things and finally I think I have found the ...
John's user avatar
  • 21
2 votes
1 answer
271 views

http referer security

quoting from Referer header: privacy and security concerns For example, consider a "reset password" page with a social media link in a footer. If the link was followed, depending on how ...
user211245's user avatar
1 vote
2 answers
9k views

Why is it not possible to spoof referer and origin header with XHR?

Technically speaking, it is possible to spoof both headers using an intercepting proxy but that's useless because we are doing it ourselves as an attacker. When we send an ajax request using JS from ...
user12507230's user avatar
0 votes
0 answers
216 views

Is it a good idea from a security standpoint to disable Referer headers in the browser? What discomforts will you have to deal with?

So what kind of discomfort will you have to deal with? Will it break websites? Or is it just a win for privacy? You can disable the Referer headers in Firefox like this: Open Firefox and type “...
Sir Muffington's user avatar
0 votes
1 answer
507 views

Referer value reflected in location response? [duplicate]

I found a login form on a website that redirects you regardless if the insert credentials are correct or wrong (302 redirect). I noticed that the value of the header Referer: is sent to header ...
Dees Peeleey's user avatar
3 votes
1 answer
563 views

Why does not Referer header use “same-origin” by default?

Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be no-referrer-...
Ilya Chernomordik's user avatar
1 vote
2 answers
3k views

CSRF Origin and Referer Header just check host?

Note: This question is not the same as the linked possible duplicate. That question asks how checking the origin/referer header protects against CSRF. This questions is asking how to implement the ...
srchulo's user avatar
  • 111
4 votes
2 answers
1k views

Opening a saved web page: Is referer file:// sent?

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer A Referer header is not sent by browsers if the referring resource is a local "file" or "data" URI. Is this true for all major, ...
forthrin's user avatar
  • 1,821
1 vote
1 answer
644 views

Fake referer is affecting my google search results

Google search result of my wordpress site is different than original content. We have taken services of security expert and they have scanned the site and database but there is no modification in code ...
Derek's user avatar
  • 79
0 votes
0 answers
119 views

Origin CSRF check fails on page load

I'm trying to build a generic filter for many applications where the developer would specify what origins they want to accept requests from and my filter would do an origin check to prevent CSRF. ...
winhowes's user avatar
  • 349
4 votes
1 answer
3k views

How to forge Referer Header in GET method triggered on HTML

I'm looking through the CSRF vulnerabilities of the DVWA. I run into the medium level which uses this piece of code to validate if the referer header equals the server name: if( eregi( $_SERVER[ '...
fish202's user avatar
  • 119
5 votes
3 answers
9k views

Is it unsafe to redirect to the referer URL?

Is it a problem when URLs in a web application redirect to the URL specified in the Referer header? It's not an open redirect like any of the /whatever?url=evil.com examples I've seen, that can be ...
mwl's user avatar
  • 51
1 vote
3 answers
721 views

Encrypted cookie to prevent csrf attacks

For preventing CSRF attacks does creating an encrypted cookie with a nonce prevent a CSRF attack? In addition, to that checking the referrer against the target origin. I cannot change 1000s of pages ...
bdawg's user avatar
  • 187
2 votes
1 answer
1k views

Why is there no referer when pointing to a secure page?

I participate to a bug bounty program and try to find serious vulnerability to expose. Firstly, I found that the company was not using CSRF token, instead of that, they use Referer to ensure the ...
Xavier59's user avatar
  • 2,924
10 votes
2 answers
3k views

How does sending referrer HTTP headers protect against CSRF attacks?

How does sending referrer HTTP headers protect against CSRF attacks? I tried logging into an HTTPS site with Firefox's network.http.sendRefererHeader set to 0 (i.e., completely disabled, as a measure ...
Geremia's user avatar
  • 1,736
5 votes
1 answer
5k views

How to check for cross-domain referrer leakage?

I am learning pen testing on web applications. I found the vulnerability cross-domain referrer leakage very interesting. Can anybody please tell me how to check for this vulnerability on any web ...
Webster's user avatar
  • 51
7 votes
1 answer
2k views

Is displaying a non-encoded HTTP Referer header vulnerable to XSS?

Consider the following PHP script (it could be any other language; I chose PHP for simplicity): <?php echo $_SERVER['HTTP_REFERER']; ?> Is it vulnerable to XSS? Of course I can send a request ...
Michał Perłakowski's user avatar
5 votes
2 answers
1k views

Is there any effective server-side prevention technique against PHP-aided CSRF?

I'm gonna start by saying it: I'm merely a cybersecurity enthusiast, not an expert. Thus, I'm gonna state what I think I know so far, please feel free to correct me at any time. Through my readings, ...
Azami's user avatar
  • 233
2 votes
0 answers
2k views

Website Link Changed to Spam in Google Search Results [closed]

My website is the first result for the search term "word search solver" in Google. Recently, I noticed a huge drop in traffic (almost all my traffic comes from Google), so I did a quick search. What I ...
Lukas's user avatar
  • 121
4 votes
0 answers
471 views

Security risks with iframe widget for different tools

We are building user profiles which can be embedded in client's websites. We are embedding those as iframe in client's web with user's id as parameter to iframe URL. We have authentication token to ...
Ruchit Rami's user avatar
3 votes
1 answer
347 views

Is using Gravatar in a web application with "private" URLs a security issue?

In our application, there is a kind of a "share" feature that sends an email to a user-provided address. This email contains a link with a secret access token (as part of the URL) that is valid for a ...
theDmi's user avatar
  • 395
2 votes
1 answer
1k views

Whitelist for HTTP request

Malicious request can come in the form of user agent string, referrer or cookie. To prevent being pawned by zero day attacks such as Shellshock, I have created a whitelist of characters for user agent ...
user68811's user avatar
1 vote
2 answers
367 views

HTTP/S <-> HTTP/S cross-site requests: what do third-party websites know about where their objects are being referenced from?

There are four general cross-site request combinations security-wise, and I want to know whether ysite.com, in each case, knows that the reason I downloaded one of its resources was because I was ...
user avatar
3 votes
1 answer
3k views

Protect against clickjacking but allow framing on domain?

I'd like to protect against clickjacking using the X-Frame-Options header, but we occasionally frame secure content on the insecure version of our site1: Since it looks like only Firefox currently ...
s4y's user avatar
  • 131
7 votes
3 answers
6k views

How to avoid referer information leakage during password reset

Most password reset systems involve emailing the user a one-time link that lets them reset their password. The token needs to be in the URL, as most email clients do not allow HTML emails to perform ...
paj28's user avatar
  • 33.4k
4 votes
3 answers
1k views

How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

I have typically implemented password reset functionality by sending a link that included something like this: http://example.com/pwreset?id=userId&resetToken=superSecretResetToken On my pwreset ...
Abe Miessler's user avatar
  • 8,185
10 votes
4 answers
17k views

Does referrer header checking offer any real world security improvement?

At work we use a central portal that provides basic SSO functionality to other applications. In addition to verifying the SSO data sent, all of our existing in-house applications (used by the public) ...
Harry Muscle's user avatar
1 vote
1 answer
1k views

Detect referer check on redirect

I have a section of my web site that I only want reachable from another portion of my web site. I know that referer spoofing is trivially easy. But, if all requests from an incorrect referrer are met ...
TBridges42's user avatar
2 votes
2 answers
2k views

What was the security vulnerability behind Box and Dropbox and what's different now?

Earlier today I received a number of comments saying that my shared links were disabled. I looked around and saw a number of articles explaining what happened, and Dropbox posted an official statement ...
MxLDevs's user avatar
  • 313
6 votes
4 answers
2k views

What risks are introduced by the browser passing the "referer" to the next site visited from a link to another domain?

As of today, I believe every major browser will by default reveal to a third-party site which site I came from, and more specifically, the exact URL I came from. What are the privacy implications of ...
RomanSt's user avatar
  • 1,220
0 votes
1 answer
145 views

What security exposure (if any) can result from lots of apparently odd referrers in server log

I see relatively many referrers such as the following (as reported by Webalizer) in a web server log. The server is located outside Russia and it's a small one. 8 3 http://tiandeural.ru/ 19 ...
Drux's user avatar
  • 391
0 votes
1 answer
369 views

Lots of bot hits, referer seems to be the variable

I've recently (over the last 15 minutes) had quite a few hits from the same IP, it's in a country on our blacklist so they just up up on our "Access Denied" page, but I was just interested in what ...
Jamie Taylor's user avatar
1 vote
0 answers
151 views

Emails about Referrer Bombing

I have received a couple of emails recently from site owners saying that they are finding referrer links in their stats with their URL path but my domain. So if a website has a page www.theirsite.com/...
Matthew Xerri's user avatar
7 votes
3 answers
2k views

What are the risk implications of not verifying referer header on login form?

Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...
Steve's user avatar
  • 15.3k