Re: Help with referer issues in XSS

Tim <[email protected]>
Newsgroups gmane.comp.security.websecurity,gmane.comp.security.web-applications
Message-ID <[email protected]>
Hi Jim,

> Some organizations choose to strip all outbound referrer headers to
> prevent information leakage. Therefor referrer defense of this nature
> is not always workable for internet facing applications.

Really?  Never come across that myself.  At least in that (rare?)
situation, the app just breaks.


> So really, you are better off using entropy (random tokens) for CSRF
> defense, and proper validation and escaping for XSS defense.

I agree, it is a better defense.  The problem lies in implementation,
particularly with CSRF.  Asking an app developer to update every form
in every page of a large application tends to be met with resistance,
in my experience,  This is particularly true in situations where the
developer didn't use an application-wide framework for form display
and validation.

On the other hand, validating just the Referer tends to be a lot
easier to implement as a short-term mitigation since it doesn't
require changes to the display of forms.

Cheers,
tim

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

[email protected]
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.