Security advisory: Breach and Django

Re:Security advisory: Breach and Django by homakov on Tuesday August 06, 2013 @11:06AM (#6166966)

>Personally I use Referer header checking as well. IME all the browsers of my users do send them. So if you extract the CSRF token, it's useless by itself unless you also can make the browser send the right Referer header (and AFAIK, all the holes such as Flash have been plugged).

do-not-use-referrer-as-csrf-protection.com

[ Parent | on HN ]

Re:Security advisory: Breach and Django by tptacek on Tuesday August 06, 2013 @11:59AM (#6167327)

I'm sad that doesn't appear to exist.

[ Parent | on HN ]

Re:Security advisory: Breach and Django by homakov on Tuesday August 06, 2013 @12:18PM (#6167448)

The parent said "as well" but I'm still insisting it referrer must not be neither a whole nor a part of CSRF protection.

[ Parent | on HN ]

Re:Security advisory: Breach and Django by tptacek on Tuesday August 06, 2013 @12:31PM (#6167538)

Sorry, I meant the specific domain you mentioned. :)

[ Parent | on HN ]