02-06-2005, 12:14 AM
|
#1 (permalink)
|
Google Guru
Join Date: Jan 2005
Location: Deep in the heart.
Posts: 2,443
Thanks: 0
Thanked 3 Times in 3 Posts
|
Referer Buys You Nothing
Chris Shiflett's Blog: Referer Buys You Nothing
2.04.2005 07:59:42 CST
Quote:
I am very surprised at how often I see Referer checking being mentioned as a safeguard against form spoofing. I can't properly express how completely useless this is. I've even had people try to argue with me, convinced that this is a sound technique.
Too many systems use this kind of authentication to ensure that the posted value comes from their own site, but, as he mentions, that is too easily spoofed. His suggestion for a added bit of security? Make a key in a hidden attribute that's unique to that loading of the form but can still be checked once the values are submitted.
|
PHP Developer
|
|
|