Using Referer Field for Authentication

Opis

The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.

Inne nazwy

referrer

While the proper spelling might be regarded as "referrer," the HTTP RFCs and their implementations use "referer," so this is regarded as the correct spelling.

Skutki

• Access Control

  Gain Privileges or Assume Identity

  Actions, which may not be authorized otherwise, can be carried out as if they were validated by the server referred to.

Zapobieganie

• Architecture and Design

  In order to usefully check if a given action is authorized, some means of strong authentication and method protection must be used. Use other means of authorization that cannot be simply spoofed. Possibilities include a username/password or certificate.

Słabość nadrzędna

• CWE-290 Authentication Bypass by Spoofing

Kiedy powstaje

• Architecture and Design — COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Dotyczy

Not Language-Specific

Źródła

1. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 17, "Referer Request Header", Page 1030, Addison Wesley, 2006
2. The CLASP Application Security Process — Secure Software, Inc., 2005