Referer-dependent response
Summary: PortSwigger Research describes a scanner finding where application responses depend systematically on whether the Referer header is present in requests, noting this behavior does not necessarily constitute a security vulnerability. The text states the Referer header is not a robust foundation for access controls and that any response content updated from Referer data should get the same defenses as other user-supplied input.
Why it matters: If any access control in your applications keys off the Referer header, the source notes it is vulnerable to Referer spoofing - meaning the check can be satisfied by a client that simply sets the header itself.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026