logo

Using Referer Field for Authentication

Draft Variant
Structure: Simple
Description

The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.

Common Consequences 1
Scope: Access Control

Impact: Gain Privileges or Assume Identity

Actions, which may not be authorized otherwise, can be carried out as if they were validated by the server referred to.
Detection Methods 1
Automated Static AnalysisHigh
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Potential Mitigations 1
Phase: Architecture and Design
In order to usefully check if a given action is authorized, some means of strong authentication and method protection must be used. Use other means of authorization that cannot be simply spoofed. Possibilities include a username/password or certificate.
Demonstrative Examples 1
The following code samples check a packet's referer in order to decide whether or not an inbound request is from a trusted host.

Code Example:

Bad
C++
c++

Code Example:

Bad
Java
java
These examples check if a request is from a trusted referer before responding to a request, but the code only verifies the referer name as stored in the request packet. An attacker can spoof the referer, thus impersonating a trusted client.
References 2
The Art of Software Security Assessment
Mark Dowd, John McDonald, and Justin Schuh
Addison Wesley
2006
ID: REF-62
The CLASP Application Security Process
Secure Software, Inc.
2005
https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf(2024-11-17)
ID: REF-18
Likelihood of Exploit

High

Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Modes of Introduction
Architecture and Design
Alternate Terms

referrer

While the proper spelling might be regarded as "referrer," the HTTP RFCs and their implementations use "referer," so this is regarded as the correct spelling.
Related Weaknesses
ChildOf: Authentication Bypass by Spoofing (CWE-290)
Taxonomy Mapping
  • CLASP
  • Software Fault Patterns