News for hackers. Stuff that matters.

A comment on Firefox 59 to strip path information from referrer values for 3rd parties. Parent comment

Re:Firefox 59 to strip path information from referrer values... by tmd83 on Thursday February 01, 2018 @07:58PM (#16287451)
This. For this you just need the origin though. There's an origin header for 10 years which makes CSRF protection so trivial yet its still not available in all browsers. Firefox can leak referer in regular mode but can't send origin? Not sure.

Anyone knows a good document on when/which browser actually sends referer header?

[ Parent | on HN ]
Re:Firefox 59 to strip path information from referrer values... by throwaway_boi on Tuesday February 06, 2018 @06:24PM (#16320931)
Firefox and Edge don't send Origin headers with POST requests[0] while all send Referer.[1]

0: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Or...

1: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...

[ Parent | on HN ]