Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I have very little knowledge in application security. I have often seen to protect your application from csrf attacks developers use tokens and pass these tokens with request to validate. I want to know if i just validate the request is coming from my server and rejects all requests coming from any other server how can it be unsafe?

share|improve this question
1  
For further reading, see security.stackexchange.com –  msanford Aug 29 '12 at 16:04

1 Answer 1

up vote 4 down vote accepted

You cannot know where the request is coming from for sure. Sure, you can check the HTTP referer, but that has implications as well.

Many users have set their browsers to not supply the server with the referrer, so you will get rubbish data. If you don't allow empty referrers you will block a lot of legitimate requests. If you allow empty referrers, then all those that have set their browser to not send referrer can be a victim of CSRF.

So rejecting requests based on this will get you nowhere.

Edit: It's called 'HTTP referer', a misspelling of the word referrer.

share|improve this answer
    
nice one.... i havent heard about this setting in browser.. +1 –  Shayan Husaini Jul 12 '12 at 14:03
1  
in firefox you can type about:config in the address field and press enter, then change value of network.http.sendRefererHeader to 0 (2 is default). –  Matsemann Jul 12 '12 at 14:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.