3-3—Referer Exposes Session ID

PUBLISHEDsecurity alertMedium

Passive

Metadata

Alert ID:: 3-3
Risk:: Medium
Type:: Passive
CWE:: CWE-200Exposure of Sensitive Information to an Unauthorized Actor

摘要

A hyperlink pointing to another host name was found. As session ID URL rewrite is used, it may be disclosed in referer header to external hosts.

解决方案

This is a risk if the session ID is sensitive and the hyperlink refers to an external or third party host. For secure content, put session ID in secured session cookie.

参考

browse all alerts