The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

100

Chapter 5 

■

Bypassing Client-Side Controls

70779c05.qxd:WileyRed  9/16/07  5:14 PM  Page 100

---

The 

Referer

header is strictly optional according to w3.org standards.

Hence although most browsers implement it, using it to control application

functionality should be regarded as a “hack.” 

C O M M O N   M Y T H

It is often assumed that HTTP headers are somehow

more “tamper-proof” than other parts of the request, such as the URL. This 

may lead developers to implement functionality that trusts the values

submitted in headers such as 

Cookie

and 

Referer

, while performing proper

validation of other data such as URL parameters. This perception is false —