4 ms·
Blocking same-site referer beyond stripping the path is something where I'd draw the line to protect the user against CSRF attacks. Do you have any evidence for
by namibj 6y ago
Blocking same-site referer beyond stripping the path is something where I'd draw the line to protect the user against CSRF attacks.
Do you have any evidence for a modern browser sending a harmful referer or allowing sending of one?
- nulbyte 6y agoFirefox can be configured[1] to never send the header or always send the target URL as the header. [1]: https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer
- namibj 6y agoInteresting. Especially the latter, considering that even the RFC [0] mentions it's usage for CSRF protection. This seems to be about as harsh as reasonable without breaking CSRF protection: network.http.sendRefererHeader=1 network.http.referer.trimmingPolicy=2 network.http.referer.XOriginPolicy=2 [0]: https://tools.ietf.org/html/rfc7231#section-5.5.2 https://tools.ietf.org/html/rfc7231#section-5.5.2
- bawolff 6y agoSure, but there is a reason why everyone uses tokens to fix csrf and not referrer.