WebApp Sec mailing list archives

Re: HTTP REFERER not set in Internet Explorer


From: Yutaka OIWA <yutaka.oiwa () gmail com>
Date: Fri, 18 Nov 2005 15:36:25 +0900

I needed one more clause...

6) Be careful about outgoing links from your application:
     If your application generates any external links, and
     the target page of the link is actually a 301/302 redirect,
     the redirected browser sends the original referer value.
     If the first request is GET method, the redirect is done
     without any user's intervention.
     This means that in many cases Referer of GET request
     is untrustful.


Current thread: