CWE-293—Using Referer Field for Authentication

名称

Using Referer Field for Authentication

描述

The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.

常见后果

范围：

Access Control

影响：

Gain Privileges or Assume Identity

注释：

Actions, which may not be authorized otherwise, can be carried out as if they were validated by the server referred to.

相关 CWE

• CWE-290Authentication Bypass by Spoofing