Hacker Newsnew | past | comments | ask | show | jobs | submit | Yengas's commentslogin

Just check the Referer header.


You can't trust the referrer header for anything security related.



Your citation does reitterate my point. I quote "However, checking the referer is considered to be a weaker from of CSRF protection."

The referrer header can be subject to all sorts of subtle edge cases such as switching between secure and unsecure content (or is it the other way around, I can't recall off hand?) which many broswers will then refuse to send a referrer header. So while checking the referrer might work most of the time, it's really not robust enough to be considered trustworthy for anything security related.


the referer header does not get set on copied and pasted urls


Since a csrf will come from a <img tag which is not on your site, you can check the header. So the only problem is if the user copy pastes the link from a website or clicks from some other application. Which decreases the chance of a substantial attack alot. If you are using http as laumars stated, this doesnt work. But i think this should be a pretty decent and easy to implement solution if you're using https.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: