3 ms·

Very cool read! Apache/nginx logs can be really interesting to look through sometimes. It is sad that the Referer Header is pretty much dead now. Looking at th

Very cool read! Apache/nginx logs can be really interesting to look through sometimes. It is sad that the Referer Header is pretty much dead now. Looking at the Apache logs used to be a useful way to see what was going on and why a site was busy suddenly. Those headers were also a great way to gather whatever analytics was called before it became what it is now. I guess we just called them 'stats' because we didn't care about ads? I once was looking at the logs for whatever reason and spotted a link back to what was clearly a webmail system at a decent sized .edu and decided to click that link. BOOM. I was looking at someone's inbox. There was no authentication at all on the email there. I did report that, hopefully they fixed it fast.

RcouF1uZ4gsC 7y ago
> There was no authentication at all on the email there. I did report that, hopefully they fixed it fast. I bet there was some token in the URL, and that URL with the token was sent as the referer, and then when you clicked the link, you also got the authentication token since it was in the URL.
- exikyut 7y ago
  Ok that was a small beer-bottle-over-the-head moment. Does this sort of disaster have a specific name? I realize it's a type of XSRF but I don't know of any contractions for "I was erroneously supplied working credentials and this needs fixing". This reminds me of the practice of digging through GitHub for leaked credentials.