3 deleted 1 characters in body; edited title
source | link

Does the practice of blocking an off-site "Referrer"Referer:" HTTP requests improve website security?

Is there any benefit for a security-paranoid website to disallow HTTP requests that have a ReferrerReferer: from 3rd party sites?

The pitch is that if such a HTTP request were to come in, then certain XSS attacks would be prevented, and certain OpenID iFrame threats as well.

The user experience would have all users in that case be redirected to a landing page. That landing page would then direct them to either manually type in the URL, or to click a hyperlink.

Is this a good idea?

Does the practice of blocking an off-site "Referrer:" HTTP requests improve website security?

Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referrer: from 3rd party sites?

The pitch is that if such a HTTP request were to come in, then certain XSS attacks would be prevented, and certain OpenID iFrame threats as well.

The user experience would have all users in that case be redirected to a landing page. That landing page would then direct them to either manually type in the URL, or to click a hyperlink.

Is this a good idea?

Does the practice of blocking an off-site "Referer:" HTTP requests improve website security?

Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?

The pitch is that if such a HTTP request were to come in, then certain XSS attacks would be prevented, and certain OpenID iFrame threats as well.

The user experience would have all users in that case be redirected to a landing page. That landing page would then direct them to either manually type in the URL, or to click a hyperlink.

Is this a good idea?

2 added 33 characters in body; edited title
source | link

Does the practice of disallowing *all*blocking an off-site "Referrer:" HTTP/S referrals requests improve website security?

Is there any benefit for a security-paranoid website to disallow all referralsHTTP requests that have a Referrer: from 3rd party sites?

The pitch I is that if such a referralHTTP request were to occurcome in, then certain XSS attacks would be prevented, and certain OpenID iFrame threats as well.

The user experience would have all users in that case be redirected to a landing page. That landing page would then direct them to either manually type in the URL, or to click a hyperlink.

Is this a good idea?

Does the practice of disallowing *all* HTTP/S referrals improve website security?

Is there any benefit for a security-paranoid website to disallow all referrals from 3rd party sites?

The pitch I is that if such a referral were to occur, then certain XSS attacks would be prevented, and certain OpenID iFrame threats as well.

The user experience would have all users in that case be redirected to a landing page. That landing page would then direct them to either manually type in the URL, or to click a hyperlink.

Is this a good idea?

Does the practice of blocking an off-site "Referrer:" HTTP requests improve website security?

Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referrer: from 3rd party sites?

The pitch is that if such a HTTP request were to come in, then certain XSS attacks would be prevented, and certain OpenID iFrame threats as well.

The user experience would have all users in that case be redirected to a landing page. That landing page would then direct them to either manually type in the URL, or to click a hyperlink.

Is this a good idea?

    Tweeted twitter.com/#!/StackSecurity/status/122612983590420481
1
source | link

Does the practice of disallowing *all* HTTP/S referrals improve website security?

Is there any benefit for a security-paranoid website to disallow all referrals from 3rd party sites?

The pitch I is that if such a referral were to occur, then certain XSS attacks would be prevented, and certain OpenID iFrame threats as well.

The user experience would have all users in that case be redirected to a landing page. That landing page would then direct them to either manually type in the URL, or to click a hyperlink.

Is this a good idea?