WebApp Sec mailing list archives

RE: HTTP REFERER not set in Internet Explorer


From: "Einecker, Leah" <leinecker () pima edu>
Date: Wed, 16 Nov 2005 17:03:57 -0700


Because of some security concerns I need the HTTP_REFERER to be set
correctly. If it is not possible, I will have to restrict my users to
a Mozilla based browser.


The Referer header is trivial to forge -- it would be dangerous to rely
on it for "security concerns". 

If you are trying to keep track of a user's progress through your site,
you could store the last N locations visited in a session object for
each session.

Cheers,
-Leah


Current thread: