{"id":19,"date":"2005-04-16T14:33:44","date_gmt":"2005-04-16T22:33:44","guid":{"rendered":"http:\/\/outflux.net\/blog\/archives\/2005\/04\/16\/referer-headers\/"},"modified":"2005-04-16T14:33:44","modified_gmt":"2005-04-16T22:33:44","slug":"referer-headers","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2005\/04\/16\/referer-headers\/","title":{"rendered":"referer headers"},"content":{"rendered":"<p>I&#8217;m surprised that anyone still uses referer headers as a &#8220;security&#8221; measure.  I&#8217;ve come across this several times recently.  I&#8217;ll select a URL out of firefox, and paste it onto a <code>curl -O<\/code> command line, only to end up with a 0-sized file.  And usually if I just add <code>-e [site URL]<\/code> to the command line, poof there&#8217;s my file.  Most recently, I found this when trying to download the freely available Nine Inch Nails <a href=\"http:\/\/www.nin.com\/current\/\">samples<\/a>.<\/p>\n<p>Seriously, what&#8217;s the point of doing this test?  I don&#8217;t understand at all.  If you want people to download a file in their web browser, do you think they can&#8217;t figure this out?<\/p>\n<p style='text-align:left'>&copy; 2005, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>I&#8217;m surprised that anyone still uses referer headers as a &#8220;security&#8221; measure. I&#8217;ve come across this several times recently. I&#8217;ll select a URL out of firefox, and paste it onto a curl -O command line, only to end up with a 0-sized file. And usually if I just add -e [site URL] to the command [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,6],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/19"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=19"}],"version-history":[{"count":0,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/19\/revisions"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=19"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=19"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=19"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}