News for hackers. Stuff that matters.
Re:Developers don't understand CORS by davidw on Wednesday July 10, 2019 @03:03PM (#20405271)
Back in the day, we used to use some Apache redirect magic to redirect to, say, an image of our choosing when the Referrer header was wrong. I had a relatively polite 'hey, you can see this image here:' message. Other people redirected to less friendly things.
Re:Developers don't understand CORS by jefftk on Wednesday July 10, 2019 @03:48PM (#20405765)
You can still do this. The Referer header is sent by default on requests, and you can make your server interpret it to do anything you want.
Re:Developers don't understand CORS by gmfawcett on Wednesday July 10, 2019 @06:09PM (#20407119)
This is true unless the referring URL is secured (HTTPS), and the destination URL is not. In that case a conformant user-agent will leave Referer out.

https://tools.ietf.org/html/rfc7231#section-5.5.2

Re:Developers don't understand CORS by jefftk on Wednesday July 10, 2019 @09:48PM (#20408459)
True, though you should run HTTPS on your site. Which means you'll get the Referer unless the other site or the user's browser has been configured to suppress it.