Bypassing Referer-based CSRF defenses
Summary: PortSwigger Research describes how applications that rely on the HTTP Referer header for CSRF defense are often subject to bypasses, since the header is optional and browsers can withhold or modify it. The text details two bypass patterns: applications that skip validation when the Referer is absent, which an attacker can trigger with a META tag in the exploit page, and naive validation that checks only whether the domain starts with or contains the expected value, which an attacker can satisfy using a subdomain or a URL containing the domain name.
Key Takeaway: Many browsers now strip the query string from the Referer by default, so a proof-of-concept that works in Burp may fail in a real browser unless the exploit response sets Referrer-Policy: unsafe-url. Any CSRF defense that treats a missing Referer as acceptable is effectively no defense at all.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026