2 ms·
Interesting. Especially the latter, considering that even the RFC [0] mentions it's usage for CSRF protection. This seems to be about as harsh as reasonable wi
by namibj 6y ago
Interesting. Especially the latter, considering that even the RFC [0] mentions it's usage for CSRF protection.
This seems to be about as harsh as reasonable without breaking CSRF protection:
network.http.sendRefererHeader=1
network.http.referer.trimmingPolicy=2
network.http.referer.XOriginPolicy=2
[0]: https://tools.ietf.org/html/rfc7231#section-5.5.2 https://tools.ietf.org/html/rfc7231#section-5.5.2
- bawolff 6y agoSure, but there is a reason why everyone uses tokens to fix csrf and not referrer.