This post originated from an RSS feed registered with PHP Buzz by Chris Shiflett. Original Post: Referer Buys You Nothing Feed Title: Chris Shiflett's Blog Feed URL: http://www.feedburner.com/fb/static/error.html Feed Description: Author, Consultant, Programmer, Speaker, Trainer Latest PHP Buzz Posts Latest PHP Buzz Posts by Chris Shiflett Latest Posts From Chris Shiflett's Blog

I am very surprised at how often I see Referer checking being mentioned as a safeguard against form spoofing. I can't properly express how completely useless this is. I've even had people try to argue with me, convinced that this is a sound technique.

Consider a hypothetical form located at http://example.org/form.html:

<form action="/process.php" method="POST"> 
<input type="text" name="foo" /> 
<input type="submit" /> 
</form>

To spoof this form, an attacker sends an HTTP POST request to http://example.org/process.php. Assuming the developer who wrote process.php is relying on Referer checking to prevent form spoofing, guess what the expected value is? Does this really seem like a big secret? An attacker will get this right every single time.

If you want to do something useful, at least use some bit of information that isn't obvious. One example is to generate a secret token and include it in the form:

<?php 
 
$token = md5(uniqid(rand(), true)); 
$_SESSION['token'] = $token; 
 
?> 
 
<form action="/process.php" method="POST"> 
<input type="hidden" name="token" value="<?php echo $token; ?>" /> 
<input type="text" name="foo" /> 
<input type="submit" /> 
</form>

You can check this value in process.php, and it's not very easy to guess. In fact, the only person with a reasonable chance of knowing this value is the person you send it to.