3 ms·
Looks like it https://security.stackexchange.com/questions/96114/why-is-referer-checking-needed-for-django-to-prevent-csrf https://security.stackexchange.com/q
by berdario 10y ago
Looks like it
https://security.stackexchange.com/questions/96114/why-is-referer-checking-needed-for-django-to-prevent-csrf https://security.stackexchange.com/questions/96114/why-is-re...
I don't think that the solution can be as simple as:
> you should not post from HTTP to HTTPS anyway.
because if the attacker is MITM'ing your user, he can supply the user a HTTP page that you never created (unless you have HSTS enabled)
The obvious inquire: "why doesn't the attacker simply steals the login cookie?", can probably be simply explained if your service is setting the Secure flag in the Set-Cookie header (as it should)... this way, even if the victim is logged in, the attacker wouldn't be able to steal the cookie
- marcosdumay 10y agoI don't think that "the site does not work while somebody is phishing my connection" is a valid complaint. One should indeed protect against malicious HTTP pages, HSTS is a good thing, browser warnings on HTTP is an even better thing. But there is no reason to put any effort on avoiding a 403 error on those cases.
- anderskaseorg 10y agoYou misunderstand the problem. Referer is checked to prevent forged POST requests from HTTP to HTTPS, not to avoid a 403 error.
- marcosdumay 10y agoMy point is that you should never POST from HTTP to HTTPS. So anytime that this happens, Django developers are more than justified on issuing any error they want and marking them wontfix as they wish.