Re: Re: disable referer ? (was: Framed & Linked Content)
| From: | Andrew Ballard | Date: | Thu, 31 Jan 2008 20:04:51 +0000 |
| Subject: | Re: Re: disable referer ? (was: Framed & Linked Content) | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-268490@lists.php.net to get a copy of this message | ||
On Jan 31, 2008 2:49 PM, Per Jessen <per@computer.org> wrote:
> Robert Cummings wrote:
>
> > Information leakage is a security issue. IMHO referer logging should
> > need to be turned on, not off.
>
> Rob, I appreciate your opinion, but like I said - when Firefox (or MSIE)
> switches off REFERER by default, we can talk again.
>
>
It's been a long time, but I seem to recall there was a version of
either Netscape or IE (pretty mainstream) around v4 that did not send
it. I was setting up one of those wonderful little formmail scripts
that used REFERER to determine whether you were allowed to submit to
the form, and was bugged at why I kept getting messages saying I
wasn't authorized when I know I came from an "authorized" page. Turns
out, the value of REFERER was blank.
Andrew