News for hackers. Stuff that matters.

A comment on Developers don't understand CORS. Parent comment

Re:Developers don't understand CORS by jefftk on Wednesday July 10, 2019 @03:48PM (#20405765)
You can still do this. The Referer header is sent by default on requests, and you can make your server interpret it to do anything you want.
[ Parent | on HN ]
Re:Developers don't understand CORS by gmfawcett on Wednesday July 10, 2019 @06:09PM (#20407119)
This is true unless the referring URL is secured (HTTPS), and the destination URL is not. In that case a conformant user-agent will leave Referer out.

https://tools.ietf.org/html/rfc7231#section-5.5.2

[ Parent | on HN ]
Re:Developers don't understand CORS by jefftk on Wednesday July 10, 2019 @09:48PM (#20408459)
True, though you should run HTTPS on your site. Which means you'll get the Referer unless the other site or the user's browser has been configured to suppress it.
[ Parent | on HN ]