Cross-domain Referer leakage
Summary: PortSwigger describes how browsers attach a Referer header to cross-domain requests, so any sensitive data in the originating URL's query string, such as a session token, is sent to the other domain. The write-up notes browsers may withhold the header in some cases, such as loading a non-HTTPS resource from an HTTPS page or on a Refresh directive, but says that behavior should not be relied on to prevent disclosure.
What you should know: If a session token sits in a URL query string, it can reach any third-party domain the page requests a resource from, and the same value may also be logged or shown on-screen to untrusted parties. PortSwigger also warns that if users can author content in the application, an attacker may inject links to a domain they control to capture data from URLs used within it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026