I found a login form on a website that redirects you regardless if the insert credentials are correct or wrong (302 redirect). I noticed that the value of the header Referer: is sent to header Location: in response. So for example, if Referer is set to https://www.google.com you will be redirected to https://www.google.com. Is it possible to set an arbitrary Referer value via CSRF and redirect other users?

New contributor
Dees Peeleey is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 4
    Possible duplicate of Send a CSRF attack with a specific header referrer? – Steffen Ullrich Oct 9 at 19:56
  • @SteffenUllrich, I'm asking if it's possible to set an arbitrary referer header value or add another referer header to the request. – Dees Peeleey Oct 9 at 20:17
  • I believe the accepted answer on the linked question does in fact answer your question. – Mike Ounsworth Oct 9 at 20:55
  • @MikeOunsworth, There's no referer restriction here. Every referer is accepted as valid redirect url. Does that mean that it's not possible? – Dees Peeleey Oct 9 at 20:57
  • The accepted answer on the other question is: "In my knowledge, referrer headers cannot be changed if there is no xss flaw. Ajax requests are also not allowed to change the referrer header". – Mike Ounsworth Oct 9 at 21:07

Reference (borrowed from the answer to the linked question):

(emphasis mine)

Verifying origin with standard headers

This defense technique is specifically proposed in section 5.0 of Robust Defenses for Cross-Site Request Forgery. This paper proposes the first creation of the Origin header and its use as a CSRF defense mechanism.

There are two steps to this mitigation, both of which rely on examining an HTTP request header value.

  • Determining the origin the request is coming from (source origin). Can be done via Origin and/or referer header.

  • Determining the origin the request is going to (target origin).

At server side we verify if both of them match. If they do, we accept the request as legitimate (meaning it's the same origin request) and if they don't, we discard the request (meaning that the request originated from cross-domain). Reliability on these headers comes from the fact that they cannot be altered programmatically (using JavaScript in an XSS) as they fall under forbidden headers list (i.e., only browsers can set them).

  • So i guess it's not possible to set another referer header, am i right? – Dees Peeleey Oct 9 at 21:47

Your Answer

Dees Peeleey is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.