CWE-293 — Using Referer Field for Authentication
CWE-293: Using Referer Field for Authentication
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Variant |
| Status | Draft |
| Likelihood of exploit | High |
Description
The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.
Common consequences
- Access Control: Gain Privileges or Assume Identity
Mitigations
Architecture and Design — In order to usefully check if a given action is authorized, some means of strong authentication and method protection must be used. Use other means of authorization that cannot be simply spoofed. Possibilities include a username/password or certificate.
References
- CWE page: https://cwe.mitre.org/data/definitions/293.html
- CWE list: https://cwe.mitre.org/data/index.html