Re: SV: [PHP] Re: HTTP_REFERER <-> Norton firewall
| From: | David Otton | Date: | Sat, 24 May 2003 16:57:59 +0000 |
| Subject: | Re: SV: [PHP] Re: HTTP_REFERER <-> Norton firewall | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-148846@lists.php.net to get a copy of this message | ||
On Sat, 24 May 2003 18:43:05 +0200, "Martin Christian Koch" wrote:
[quoting fixed]
>>> Due to the fact that Norton firewall takes control of the value of
>>> HTTP_REFERER, I want to find another way to secure data.
>>HTTP_REFERER is set by the browser, so you can not rely on that!
>Gee - thanks mate - that really helped ... or maybe not.
>
>Anybody knows a solution to the problem ?
He told you exactly what you need to know - the REFERER line is set by the
client, and should not be used as a security mechanism.
It's not just NPF in paranoid mode that rewrites the referrer... pretty much
every Junkbuster-like proxy does. Opera and other browsers have security
settings to disable it, too.
Use sessions.