4 ms·
We check the HTTP_REFERER to make sure it's coming from linkherd.com.
by bdr 19y ago
We check the HTTP_REFERER to make sure it's coming from linkherd.com.
- martin 19y agoThat can be easily fudged, can it not?
- bdr 19y agoYes, but not to do the kind of attack simonw is thinking about. You can't set the header from Javascript or HTML. You can forge it from older versions of Flash, but Flash 9 has enough penetration now that it's safe.
- rms 19y agoSo what's to stop an attacker from downloading an old version of flash?
- deleted 19y ago[deleted]
- bdr 19y agoOnly browsers with an old version of Flash installed can be tricked into executing a forged cross-site request. The attacker wouldn't gain anything by installing it on their own machine.
- there 19y agoi have my browser configured not to send referrers.
- dcurtis 19y agoWhy?
- simonw 19y agoForm tokens are more robust - some people strip referrers (sometimes even at the firewall level) to prevent information leakage from their corporate intranets.
- bdr 19y agoWeird. Anyways, we changed to form tokens.