Re: Referer Spoofing

On Jul 29, 2018, at 4:45 PM, Ricardo Iramar dos Santos <riramar@gmail.com> wrote:

> Can we rely on referer request header? 

The referrer header is completely under the control of the client (just like the User-agent header). They provide you useful information in those cases where the client has no reason to be deceptive. So these are reasonably trustworthy exactly when the client has no reason to lie.

If, however, the client can gain certain access to resources or additional privileges by lying about its referer then you absolutely cannot trust it.

> I couldn't find any official documentation from any modern browser explicitly saying that referer request header cannot be spoofed without using internal API (e.g. browser extensions).

I don’t know whether a typical browser makes it easy or hard to spoof the header, but using (or building) atypical browsers certainly would. So again, if the client may be malicious then you cannot trust the referer header.

> In the past IE/Edge had some issues (https://www.brokenbrowser.com/referer-spoofing-defeating-xss-filter/) but this was fixed long time ago.

Using the referer header as an XSS defense or for access control is asking for trouble. Don’t do that. Really, don’t do that.

Cheers,

-j

–- 
Jeffrey Goldberg
Chief Defender Against the Dark Arts @ 1Password
https://1password.com