New answers tagged


Except for special circumstances (see below) or an especially high-security environment like online banking (then they should use a whitelist of destinations, or perhaps not redirect at all), I would say that this is not a risk worth mentioning. If you can't redirect to anything that is fully or even partially under the control of an attacker, there isn't ...


Now the question is how then I can access for example from google search Twitter is conveniently ignoring the referer header because you are landing on a unauthenticated page Cross-origin request can lead to CSRF when the session is created and request is leading to a state change. from here, the ...


Those pages which end up in Google results are not protected via a check on the Referer (sic) header. The referrer checks are (mostly) done when changing data or accessing sensitive data. Those kind of pages don't end up in Google search results, as they are often POST requests or only visible after logging in, which the Google crawler does not do.

Top 50 recent answers are included