Skip to content
OpenAdvisories

Weakness (CWE)

CWE-293: Using Referer Field for Authentication

Variant Draft

The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.

How to prevent it (1 mitigation)

  1. Architecture and Design

    In order to usefully check if a given action is authorized, some means of strong authentication and method protection must be used. Use other means of authorization that cannot be simply spoofed. Possibilities include a username/password or certificate.

Source: MITRE CWE-293

All Critical High Medium Low Exploited only Public exploit

1 result · Feed