Re: Help with referer issues in XSS

James Manico wrote on 3/2/2012 1:24 PM:
> Referrer header defense is reasonable for intranet facing applications
> where referrer header policy is controlled.
>
> Some organizations choose to strip all outbound referrer headers to
> prevent information leakage. Therefor referrer defense of this nature
> is not always workable for internet facing applications.
>
> So really, you are better off using entropy (random tokens) for CSRF
> defense, and proper validation and escaping for XSS defense.

Using the referrer as a CSRF defense works when the site is HTTPS and you disallow requests with an omitted referrer header.  Only a tiny fraction of internet users suppress the referrer header over HTTPS:

"The Referer header can be used as a CSRF defense for HTTPS requests.  In order to use the Referer header as a CSRF defense, a site must reject requests that omit the header because an attacker can cause the browser to suppress the header. Over HTTP, sites cannot afford to block requests that lack a Referer header because they would cease to be compatible with the sizable percentage (roughly 3–11%) of users. Over HTTPS, however, strict Referer validation is feasible because only a tiny percentage (0.05–0.22%) of browsers suppress the header. In particular, strict Referer validation is well-suited for preventing login CSRF because login requests are typically issued over HTTPS."

Source: http://seclab.stanford.edu/websec/csrf/csrf.pdf


That paper discusses various techniques for CSRF defense and is worth a read for those interested in this topic.


- Bil

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

[email protected]
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org