Forum Discussion
reldar_76465
Nimbostratus
NimbostratusAllowing access by referrer
Hi,
I have a client who wants to exclusively connect to a web site we created for them. we agreed to do this by identifying the referrer they are coming to our site with.
As they are coming ...
hoolio
Cirrostratus
CirrostratusIt's a bad security practice to depend on the Referer header to verify whether a request should allowed to a web app. The referer header (and all other HTTP headers) can easily be spoofed by a malicious client. It would be much more secure to use some authentication mechanism to enforce access control. Or worst case, lock access down by source IP address.
Aaron
