4 ms·
Firefox can be configured[1] to never send the header or always send the target URL as the header. [1]: https://wiki.mozilla.org/Security/Referrer https://wiki
by nulbyte 6y ago
Firefox can be configured[1] to never send the header or always send the target URL as the header.
[1]: https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer
- namibj 6y agoInteresting. Especially the latter, considering that even the RFC [0] mentions it's usage for CSRF protection. This seems to be about as harsh as reasonable without breaking CSRF protection: network.http.sendRefererHeader=1 network.http.referer.trimmingPolicy=2 network.http.referer.XOriginPolicy=2 [0]: https://tools.ietf.org/html/rfc7231#section-5.5.2 https://tools.ietf.org/html/rfc7231#section-5.5.2
- bawolff 6y agoSure, but there is a reason why everyone uses tokens to fix csrf and not referrer.