Can I rely on Referer HTTP header?

by

As a general rule, you should not trust the HTTP Referer Header for any matter of importance, except for purely informative statistical analysis of who your visitors are or when looking for patterns of behaviour among the users of your own site.

Under no circumstance it is advisable that you use this header for AAA (Authentication, Authorization and Accounting), unless, as commented above, you consider Accounting the simple traffic analysis of your visitor’s behavior.

The Common Weakness Enumeration lists this weakness as CWE-293: Using Referer Field for Authentication:

The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.

Some other and more specific reasons not to trust the Referer Header, include:

  • In general, when “linking” from an HTTP <-> HTTPS (TLS) connection, most standard Web browsers will not inform this header.

  • For privacy reasons, many corporate proxies are configured to remove/strip this header, so even if a Web browser sends this header, a corporate proxy software may remove it.

  • Out in the wild security solutions, malware, browsers embedded into applications… are known to modify and/or cheat on the contents of this header.

Beware that:

  • When “linking” from HTTPS to HTTPS, most standard Web browsers will inform this header even when changing the domain name or network address destination.

More Related Contents:

  1. 403 Forbidden vs 401 Unauthorized HTTP responses
  2. How can I view HTTP headers in Google Chrome?
  3. In what cases will HTTP_REFERER be empty
  4. What is http multipart request?
  5. What’s the “Content-Length” field in HTTP header?
  6. What character encoding should I use for a HTTP header?
  7. Axios get access to response header fields
  8. Getting the HTTP Referrer in ASP.NET
  9. Best HTTP Authorization header type for JWT
  10. What exactly does the Access-Control-Allow-Credentials header do?
  11. Are Duplicate HTTP Response Headers acceptable?
  12. Operating System from User-Agent HTTP Header [closed]
  13. Specifying HTTP referer in embedded UIWebView
  14. JMeter Alter HTTP Headers During Test
  15. Is this statement correct? HTTP GET method always has no message body
  16. what’s the difference between Expires and Cache-Control headers?
  17. What are Content-Language and Accept-Language?
  18. Does the order of headers in an HTTP response ever matter?
  19. How do you send a HEAD HTTP request in Python 2?
  20. Force file download with php using header()
  21. Does $_SERVER[‘HTTP_X_REQUESTED_WITH’] exist in PHP or not?
  22. HTTP post XML data in C#
  23. Passing headers with axios POST request
  24. Nginx proxy Amazon S3 resources
  25. How to send 500 Internal Server Error error from a PHP script
  26. How to get final URL after following HTTP redirections in pure PHP?
  27. Client-side detection of HTTP request method
  28. What is HTTP “Host” header?
  29. Using the HTTP Range Header with a range specifier other than bytes?
  30. Duplicate headers received from server

Leave a Comment