Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [referer]

Referer is the HTTP request header field that contains the address of the webpage from where the request for a web resource originated.

3
votes
1answer
78 views

Why does not Referer header use “same-origin” by default?

Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be no-referrer-...
0
votes
2answers
412 views

CSRF Origin and Referer Header just check host?

Note: This question is not the same as the linked possible duplicate. That question asks how checking the origin/referer header protects against CSRF. This questions is asking how to implement the ...
3
votes
2answers
244 views

Opening a saved web page: Is referer file:// sent?

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer A Referer header is not sent by browsers if the referring resource is a local "file" or "data" URI. Is this true for all major, ...
1
vote
1answer
172 views

Fake referer is affecting my google search results

Google search result of my wordpress site is different than original content. We have taken services of security expert and they have scanned the site and database but there is no modification in code ...
0
votes
0answers
69 views

Are these HTTP_REFERER from a bot-net? Are they harmful? How should I handle them?

We are getting a huge amount of requests that I can not explain. These request all go to admin.OURWEBSITE.com/api/analyze/, but we do not have an admin subdomain and we do not have an api/analyze ...
0
votes
0answers
26 views

Origin CSRF check fails on page load

I'm trying to build a generic filter for many applications where the developer would specify what origins they want to accept requests from and my filter would do an origin check to prevent CSRF. ...
4
votes
1answer
1k views

How to forge Referer Header in GET method triggered on HTML

I'm looking through the CSRF vulnerabilities of the DVWA. I run into the medium level which uses this piece of code to validate if the referer header equals the server name: if( eregi( $_SERVER[ '...
3
votes
3answers
3k views

Is it unsafe to redirect to the referer URL?

Is it a problem when URLs in a web application redirect to the URL specified in the Referer header? It's not an open redirect like any of the /whatever?url=evil.com examples I've seen, that can be ...
1
vote
3answers
204 views

Encrypted cookie to prevent csrf attacks

For preventing CSRF attacks does creating an encrypted cookie with a nonce prevent a CSRF attack? In addition, to that checking the referrer against the target origin. I cannot change 1000s of pages ...
2
votes
1answer
721 views

Why is there no referer when pointing to a secure page?

I participate to a bug bounty program and try to find serious vulnerability to expose. Firstly, I found that the company was not using CSRF token, instead of that, they use Referer to ensure the ...
8
votes
2answers
1k views

How does sending referrer HTTP headers protect against CSRF attacks?

How does sending referrer HTTP headers protect against CSRF attacks? I tried logging into an HTTPS site with Firefox's network.http.sendRefererHeader set to 0 (i.e., completely disabled, as a measure ...
4
votes
1answer
2k views

How to check for cross-domain referrer leakage?

I am learning pen testing on web applications. I found the vulnerability cross-domain referrer leakage very interesting. Can anybody please tell me how to check for this vulnerability on any web ...
5
votes
1answer
1k views

Is displaying a non-encoded HTTP Referer header vulnerable to XSS?

Consider the following PHP script (it could be any other language; I chose PHP for simplicity): <?php echo $_SERVER['HTTP_REFERER']; ?> Is it vulnerable to XSS? Of course I can send a request ...
4
votes
2answers
599 views

Is there any effective server-side prevention technique against PHP-aided CSRF?

I'm gonna start by saying it: I'm merely a cybersecurity enthusiast, not an expert. Thus, I'm gonna state what I think I know so far, please feel free to correct me at any time. Through my readings, ...
2
votes
0answers
2k views

Website Link Changed to Spam in Google Search Results [closed]

My website is the first result for the search term "word search solver" in Google. Recently, I noticed a huge drop in traffic (almost all my traffic comes from Google), so I did a quick search. What I ...
4
votes
0answers
273 views

Security risks with iframe widget for different tools

We are building user profiles which can be embedded in client's websites. We are embedding those as iframe in client's web with user's id as parameter to iframe URL. We have authentication token to ...
3
votes
1answer
201 views

Is using Gravatar in a web application with “private” URLs a security issue?

In our application, there is a kind of a "share" feature that sends an email to a user-provided address. This email contains a link with a secret access token (as part of the URL) that is valid for a ...
2
votes
1answer
682 views

Whitelist for HTTP request

Malicious request can come in the form of user agent string, referrer or cookie. To prevent being pawned by zero day attacks such as Shellshock, I have created a whitelist of characters for user agent ...
1
vote
2answers
268 views

HTTP/S <-> HTTP/S cross-site requests: what do third-party websites know about where their objects are being referenced from?

There are four general cross-site request combinations security-wise, and I want to know whether ysite.com, in each case, knows that the reason I downloaded one of its resources was because I was ...
3
votes
1answer
2k views

Protect against clickjacking but allow framing on domain?

I'd like to protect against clickjacking using the X-Frame-Options header, but we occasionally frame secure content on the insecure version of our site1: Since it looks like only Firefox currently ...
5
votes
3answers
3k views

How to avoid referer information leakage during password reset

Most password reset systems involve emailing the user a one-time link that lets them reset their password. The token needs to be in the URL, as most email clients do not allow HTML emails to perform ...
2
votes
2answers
999 views

How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

I have typically implemented password reset functionality by sending a link that included something like this: http://example.com/pwreset?id=userId&resetToken=superSecretResetToken On my pwreset ...
4
votes
4answers
10k views

Does referrer header checking offer any real world security improvement?

At work we use a central portal that provides basic SSO functionality to other applications. In addition to verifying the SSO data sent, all of our existing in-house applications (used by the public) ...
0
votes
1answer
807 views

Detect referer check on redirect

I have a section of my web site that I only want reachable from another portion of my web site. I know that referer spoofing is trivially easy. But, if all requests from an incorrect referrer are met ...
2
votes
2answers
1k views

What was the security vulnerability behind Box and Dropbox and what's different now?

Earlier today I received a number of comments saying that my shared links were disabled. I looked around and saw a number of articles explaining what happened, and Dropbox posted an official statement ...
6
votes
4answers
982 views

What risks are introduced by the browser passing the “referer” to the next site visited from a link to another domain?

As of today, I believe every major browser will by default reveal to a third-party site which site I came from, and more specifically, the exact URL I came from. What are the privacy implications of ...
0
votes
1answer
93 views

What security exposure (if any) can result from lots of apparently odd referrers in server log

I see relatively many referrers such as the following (as reported by Webalizer) in a web server log. The server is located outside Russia and it's a small one. 8 3 http://tiandeural.ru/ 19 ...
0
votes
1answer
310 views

Lots of bot hits, referer seems to be the variable

I've recently (over the last 15 minutes) had quite a few hits from the same IP, it's in a country on our blacklist so they just up up on our "Access Denied" page, but I was just interested in what ...
1
vote
0answers
87 views

Emails about Referrer Bombing

I have received a couple of emails recently from site owners saying that they are finding referrer links in their stats with their URL path but my domain. So if a website has a page www.theirsite.com/...
7
votes
3answers
1k views

What are the risk implications of not verifying referer header on login form?

Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...