I participate to a bug bounty program and try to find serious vulnerability to expose.
Firstly, I found that the company was not using
CSRF token, instead of that, they use
Referer to ensure the request is made from
Referer tend to be less secure than
CSRF token, that's why I started to search for Open URL Vulnerability. After a few hours of search, I finally foud one. An input like
https://m.example.com/?app=desktop&location=/admin?doSomeAction=stuff will result in the following Location header :
Reading Wikipedia about
https, I noticed the following line :
If a website is accessed from a HTTP Secure (HTTPS) connection and a link points to anywhere except another secure location, then the referrer field is not sent.
As I am being redirect to a secure location, why is the
Referer header not send when accessing
Edit : Browser does not change
Location redirection. I got confused due to this post : https://security.stackexchange.com/a/24404/110133.
Now I wonder, if instead of
Location, the page was sending content with
<script>document.location="https://example.com/example.com/admin?doSomeAction=stuff"</script> would it change the referer ?