HTTP Referrer Gotchas?

Question

I need to ensure that my webpage is always within an iframe owned by a 3rd party. This third party refers to our landing page using src="../index.php".

Now my question is, if I make use of referrer to ensure that the page was requested by either myself or from the third party and if not force a reload of the 3rd party site, are there any big gotchas I should be aware of?

For example, are there certain common browsers that don't follow the referrer rules?

Thank you.

Answer 1

You can't use referrer to "ensure" that the webpage is always being called from somewhere else because of referrer spoofing.

Answer 2

The only way you could do this is to directly authorize the request because of referrer manipulation..

You could restrict requests to a set of IP addresses, if you want to be lax, or require that the including client/system has an authentication cookie for requests shown in the iframe.

Good Luck

Answer 3

Referrers are not required. If a browser doesn't supply it then you'll get yourself into an endless redirect loop. Referrer is effectively "voluntary" just like cookies, java, and javascript.

Although. You could keep a log of IP & time last redirected. Prune the logs for anything over 5 minutes old and never redirect more than once per 5 minutes. You should catch 99.9% of users out there but avoid an infinite redirect loop for the rest. The log cannot rely on anything in the browser (that's the original problem) so no cookie and no session. A simple 2-column database table should suffice.

Answer 4

Be aware that Internet Explorer (all versions) specifically OMITS the HTTP REFERRER whenever a user navigates to a link as a result of JavaScript. (bug report)

e.g.

function doSomething(url){
  //save some data to the session
  //...
  location.href = url;//IE will NOT pass the HTTP REFERRER on this link
}

Answer 5

Also, it's REFERER because it somehow got misspelled in the spec. That was my very first REFERER gotcha.