Re: Help with referer issues in XSS

Short term defense? Sure thing. Long term robust defense? I
respectfully think not.

I prefer my CSRF defense mechanisms to have strong randomness unique
to each request, in addition to robust XSS defense, since XSS can be
used to circumvent almost any CSRF defense mechanism.

Browser bugs have made methods like referrer checking, dependence on
SOP and double-submit cookies circumventable in the past. At least
with XSS defense and CSRF tokens, you have control over the defensive
mechanism and do not lean on browser security.

--
Jim Manico
VP, Security Architecture
WhiteHat Security
(808) 652-3805

On Mar 2, 2012, at 10:34 PM, Tim <[email protected]> wrote:

>
> Hi Jim,
>
>> Some organizations choose to strip all outbound referrer headers to
>> prevent information leakage. Therefor referrer defense of this nature
>> is not always workable for internet facing applications.
>
> Really?  Never come across that myself.  At least in that (rare?)
> situation, the app just breaks.
>
>
>> So really, you are better off using entropy (random tokens) for CSRF
>> defense, and proper validation and escaping for XSS defense.
>
> I agree, it is a better defense.  The problem lies in implementation,
> particularly with CSRF.  Asking an app developer to update every form
> in every page of a large application tends to be met with resistance,
> in my experience,  This is particularly true in situations where the
> developer didn't use an application-wide framework for form display
> and validation.
>
> On the other hand, validating just the Referer tends to be a lot
> easier to implement as a short-term mitigation since it doesn't
> require changes to the display of forms.
>
> Cheers,
> tim

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

[email protected]
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org