Re: Help with referer issues in XSS
Tim <[email protected]>
| Newsgroups | gmane.comp.security.websecurity,gmane.comp.security.web-applications |
|---|---|
| Message-ID | <[email protected]> |
Hi Jim, > Some organizations choose to strip all outbound referrer headers to > prevent information leakage. Therefor referrer defense of this nature > is not always workable for internet facing applications. Really? Never come across that myself. At least in that (rare?) situation, the app just breaks. > So really, you are better off using entropy (random tokens) for CSRF > defense, and proper validation and escaping for XSS defense. I agree, it is a better defense. The problem lies in implementation, particularly with CSRF. Asking an app developer to update every form in every page of a large application tends to be met with resistance, in my experience, This is particularly true in situations where the developer didn't use an application-wide framework for form display and validation. On the other hand, validating just the Referer tends to be a lot easier to implement as a short-term mitigation since it doesn't require changes to the display of forms. Cheers, tim _______________________________________________ The Web Security Mailing List WebSecurity RSS Feed http://www.webappsec.org/rss/websecurity.rss Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA WASC on Twitter http://twitter.com/wascupdates [email protected] http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org