Questions tagged [referer]
Referer is the HTTP request header field that contains the address of the webpage from where the request for a web resource originated.
43
questions
2
votes
1
answer
757
views
CSRF: Signed Double Submit Cookie & 'Referer' validation vs MITM and vulnerable subdomains
I have been researching various techniques for preventing CSRF attacks, such as SOP, SameSite, Secure, Referer validation, and CSRF Tokens, and their potential bypasses. During my research, I ...
1
vote
0
answers
755
views
Changing referer value in burp request has no impact on the response
I am testing a request/response of an application using the burp suite and found that changing the Referer value has no effect on the response.
The Referer contains the URL along with the unique ID of ...
1
vote
1
answer
763
views
Is it recommended to set Referrer-Policy explicitly when the browsers already has a default policy?
I wanted to explicitly define the referrer-policy as "strict-origin-when-cross-origin" in my web application. However, "strict-origin-when-cross-origin" is the browser's default ...
0
votes
1
answer
162
views
How do applications which are integrated using a javascript client side sdk, secure their data or disallow spam?
Take an example of google maps. google maps provides a javascript client SDK, which means any web app running javascript can access the google maps sdk. You need to use an API_KEY so that google can ...
6
votes
1
answer
2k
views
using rel="noreferer" without rel="noopener" or without target="_blank"
I have been reading about the security and performance implications of rel="noopener" and rel="noreferrer" in links with target="_blank". These are some of the ...
1
vote
2
answers
245
views
How some sites prevent cross-site requests through referrer although there are redirections allowed
I read about referrer header that some sites use to allow only requests made by the pages of the site. So if I make a page hacker.com, and let this page make a request to https://twitter.com/i/flow/...
1
vote
1
answer
293
views
Why did browser authors not make 127.0.0.1/localhost-hosted webpages skip the referrer?
For a long time, I was so convinced that 127.0.0.1/localhost-hosted webpages, that is, with URLs such as:
http://127.0.0.1/MySecretControlPanel/sensitive.php?stuff=goes&here=dude
... did not ...
3
votes
1
answer
663
views
Retrieving CSRF token from third party website form using XHR (JavaScript)
I know they say CSRF tokens are the most secure way to prevent CSRF attacks but what if someone uses XHR to retrieve the page containing the csrf token along with the form and then use that token for ...
1
vote
1
answer
559
views
If an application has an XSS vulnerabilty, can we bypass CSRF with referer header?
Let's say there is an XSS vulnerability in an application, and the application is not using any kind of CSRF token, just using the referer header to protect against CSRF. Referer header is validating ...
2
votes
1
answer
2k
views
Is there any way to pretend like we are routing our request via cloudflare? [closed]
There is this Web App which uses cloudflare and to bypass certain things I had to find a way to access the actual web server directly. I tried numerous things and finally I think I have found the ...
2
votes
1
answer
271
views
http referer security
quoting from Referer header: privacy and security concerns
For example, consider a "reset password" page with a social media link
in a footer. If the link was followed, depending on how ...
1
vote
2
answers
9k
views
Why is it not possible to spoof referer and origin header with XHR?
Technically speaking, it is possible to spoof both headers using an intercepting proxy but that's useless because we are doing it ourselves as an attacker.
When we send an ajax request using JS from ...
0
votes
0
answers
216
views
Is it a good idea from a security standpoint to disable Referer headers in the browser? What discomforts will you have to deal with?
So what kind of discomfort will you have to deal with?
Will it break websites?
Or is it just a win for privacy?
You can disable the Referer headers in Firefox like this:
Open Firefox and type “...
0
votes
1
answer
507
views
Referer value reflected in location response? [duplicate]
I found a login form on a website that redirects you regardless if the insert credentials are correct or wrong (302 redirect). I noticed that the value of the header Referer: is sent to header ...
3
votes
1
answer
563
views
Why does not Referer header use “same-origin” by default?
Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be no-referrer-...
1
vote
2
answers
3k
views
CSRF Origin and Referer Header just check host?
Note: This question is not the same as the linked possible duplicate. That question asks how checking the origin/referer header protects against CSRF. This questions is asking how to implement the ...
4
votes
2
answers
1k
views
Opening a saved web page: Is referer file:// sent?
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer
A Referer header is not sent by browsers if the referring resource is
a local "file" or "data" URI.
Is this true for all major, ...
1
vote
1
answer
644
views
Fake referer is affecting my google search results
Google search result of my wordpress site is different than original content. We have taken services of security expert and they have scanned the site and database but there is no modification in code ...
0
votes
0
answers
119
views
Origin CSRF check fails on page load
I'm trying to build a generic filter for many applications where the developer would specify what origins they want to accept requests from and my filter would do an origin check to prevent CSRF. ...
4
votes
1
answer
3k
views
How to forge Referer Header in GET method triggered on HTML
I'm looking through the CSRF vulnerabilities of the DVWA. I run into the medium level which uses this piece of code to validate if the referer header equals the server name:
if( eregi( $_SERVER[ '...
5
votes
3
answers
9k
views
Is it unsafe to redirect to the referer URL?
Is it a problem when URLs in a web application redirect to the URL specified in the Referer header?
It's not an open redirect like any of the /whatever?url=evil.com examples I've seen, that can be ...
1
vote
3
answers
721
views
Encrypted cookie to prevent csrf attacks
For preventing CSRF attacks does creating an encrypted cookie with a nonce prevent a CSRF attack? In addition, to that checking the referrer against the target origin. I cannot change 1000s of pages ...
2
votes
1
answer
1k
views
Why is there no referer when pointing to a secure page?
I participate to a bug bounty program and try to find serious vulnerability to expose.
Firstly, I found that the company was not using CSRF token, instead of that, they use Referer to ensure the ...
10
votes
2
answers
3k
views
How does sending referrer HTTP headers protect against CSRF attacks?
How does sending referrer HTTP headers protect against CSRF attacks?
I tried logging into an HTTPS site with Firefox's network.http.sendRefererHeader set to 0 (i.e., completely disabled, as a measure ...
5
votes
1
answer
5k
views
How to check for cross-domain referrer leakage?
I am learning pen testing on web applications. I found the vulnerability cross-domain referrer leakage very interesting. Can anybody please tell me how to check for this vulnerability on any web ...
7
votes
1
answer
2k
views
Is displaying a non-encoded HTTP Referer header vulnerable to XSS?
Consider the following PHP script (it could be any other language; I chose PHP for simplicity):
<?php
echo $_SERVER['HTTP_REFERER'];
?>
Is it vulnerable to XSS?
Of course I can send a request ...
5
votes
2
answers
1k
views
Is there any effective server-side prevention technique against PHP-aided CSRF?
I'm gonna start by saying it: I'm merely a cybersecurity enthusiast, not an expert. Thus, I'm gonna state what I think I know so far, please feel free to correct me at any time.
Through my readings, ...
2
votes
0
answers
2k
views
Website Link Changed to Spam in Google Search Results [closed]
My website is the first result for the search term "word search solver" in Google. Recently, I noticed a huge drop in traffic (almost all my traffic comes from Google), so I did a quick search. What I ...
4
votes
0
answers
471
views
Security risks with iframe widget for different tools
We are building user profiles which can be embedded in client's websites. We are embedding those as iframe in client's web with user's id as parameter to iframe URL.
We have authentication token to ...
3
votes
1
answer
347
views
Is using Gravatar in a web application with "private" URLs a security issue?
In our application, there is a kind of a "share" feature that sends an email to a user-provided address. This email contains a link with a secret access token (as part of the URL) that is valid for a ...
2
votes
1
answer
1k
views
Whitelist for HTTP request
Malicious request can come in the form of user agent string, referrer or cookie. To prevent being pawned by zero day attacks such as Shellshock, I have created a whitelist of characters for user agent ...
1
vote
2
answers
367
views
HTTP/S <-> HTTP/S cross-site requests: what do third-party websites know about where their objects are being referenced from?
There are four general cross-site request combinations security-wise, and I want to know whether ysite.com, in each case, knows that the reason I downloaded one of its resources was because I was ...
3
votes
1
answer
3k
views
Protect against clickjacking but allow framing on domain?
I'd like to protect against clickjacking using the X-Frame-Options header, but we occasionally frame secure content on the insecure version of our site1:
Since it looks like only Firefox currently ...
7
votes
3
answers
6k
views
How to avoid referer information leakage during password reset
Most password reset systems involve emailing the user a one-time link that lets them reset their password. The token needs to be in the URL, as most email clients do not allow HTML emails to perform ...
4
votes
3
answers
1k
views
How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?
I have typically implemented password reset functionality by sending a link that included something like this:
http://example.com/pwreset?id=userId&resetToken=superSecretResetToken
On my pwreset ...
10
votes
4
answers
17k
views
Does referrer header checking offer any real world security improvement?
At work we use a central portal that provides basic SSO functionality to other applications. In addition to verifying the SSO data sent, all of our existing in-house applications (used by the public) ...
1
vote
1
answer
1k
views
Detect referer check on redirect
I have a section of my web site that I only want reachable from another portion of my web site. I know that referer spoofing is trivially easy. But, if all requests from an incorrect referrer are met ...
2
votes
2
answers
2k
views
What was the security vulnerability behind Box and Dropbox and what's different now?
Earlier today I received a number of comments saying that my shared links were disabled. I looked around and saw a number of articles explaining what happened, and Dropbox posted an official statement
...
6
votes
4
answers
2k
views
What risks are introduced by the browser passing the "referer" to the next site visited from a link to another domain?
As of today, I believe every major browser will by default reveal to a third-party site which site I came from, and more specifically, the exact URL I came from.
What are the privacy implications of ...
0
votes
1
answer
145
views
What security exposure (if any) can result from lots of apparently odd referrers in server log
I see relatively many referrers such as the following (as reported by Webalizer) in a web server log. The server is located outside Russia and it's a small one.
8 3 http://tiandeural.ru/
19 ...
0
votes
1
answer
369
views
Lots of bot hits, referer seems to be the variable
I've recently (over the last 15 minutes) had quite a few hits from the same IP, it's in a country on our blacklist so they just up up on our "Access Denied" page, but I was just interested in what ...
1
vote
0
answers
151
views
Emails about Referrer Bombing
I have received a couple of emails recently from site owners saying that they are finding referrer links in their stats with their URL path but my domain. So if a website has a page www.theirsite.com/...
7
votes
3
answers
2k
views
What are the risk implications of not verifying referer header on login form?
Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...