If you do that, you then have to make sure your app doesn't have any redirector anywhere or anything that writes Location. Almost all apps do. This is because y

If you do that, you then have to make sure your app doesn't have any redirector anywhere or anything that writes Location. Almost all apps do. This is because you can get the site to insert the right referrer. for eg. if the URL of the attack request is (both of these are close to real life examples that work(ed)) http://www.site.com/mail/filter?create=*%2Cattacker%40hush.com http://www.site.com/mail/filter?create=*%2Cattacker%40hush.c... usually the site will have a redirector on the login action, which takes the user back to the page that they were on after login, so you just use the attack URL as the redir URL http://www.site.com/login?return_to=%2Fmail%2Ffilter%3Fcreate=*%2Cattacker%40hush.com http://www.site.com/login?return_to=%2Fmail%2Ffilter%3Fcreat... amazing how many login scripts still do the redirect even if the user is already logged in, or still do the redirect even if there is no real login even if you do a javascript in-place login, there is usually a mobile version that has this pattern. I rarely meet a site that doesn't have a way to bounce between URLs and fake the referrer. I guess the real conclusion is that these types of attacks are complicated and better understood fully than implying a single short solution - because the next response is always "but, if you do that, then" and so forth, like a matryoshka doll