The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.
N/A
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
N/A
N/A
| Phase | Note |
|---|---|
| Architecture and Design | COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic. |
Intro: The following code samples check a packet's referer in order to decide whether or not an inbound request is from a trusted host.
Body: These examples check if a request is from a trusted referer before responding to a request, but the code only verifies the referer name as stored in the request packet. An attacker can spoof the referer, thus impersonating a trusted client.
String trustedReferer = "http://www.example.com/" while(true){ n = read(newsock, buffer, BUFSIZE); requestPacket = processPacket(buffer, n); if (requestPacket.referer == trustedReferer){ openNewSecureSession(requestPacket); } }