CWE-293
Using Referer Field for Authentication
AI Translation Available
The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.
Status
draft
Abstraction
variant
Likelihood
high
Affected Platforms
Technical Details
AI Translation
Common Consequences
access control
Impacts
gain privileges or assume identity
Detection Methods
automated static analysis
Potential Mitigations
Phases:
architecture and design
Descriptions:
•
In order to usefully check if a given action is authorized, some means of strong authentication and method protection must be used. Use other means of authorization that cannot be simply spoofed. Possibilities include a username/password or certificate.