|
|
Posted by Chung Leong on 03/10/06 02:05
Justin Koivisto wrote:
> Chung Leong wrote:
> >
> > A check on HTTP_REFERER is actually sufficient too, since ordinary
> > users aren't going to be spoofing the Referer headers.
>
> Anyone that is running a firewall program like Norton's Personal
> Firewall won't send the referrer... There are a number of web proxies
> out there that do the same. Don't even bother with the HTTP_REFERER for
> anything.
If HTTP_REFERER is empty, then bypass the test. Really, one should
consider each scenario carefully instead of just blindly repeating some
axiom. In this case, making cross-site posting not functional a
majority of the times is sufficient in deterring sites from doing it.
Navigation:
[Reply to this message]
|