Securing forms using $_SERVER['HTTP_REFERER']

saidbakr

Hi,

In some situations we have to client-side in order to format inserted or updated contents using a form. This is may be clear when using text-area replacement such as FCK Editor. We need a way to prevent the following scenario:

The user browse to the form page http://www.mysite.com/form.php. There he will using the browser Save As and then save complete HTML page of the form page.

Now he ready to change the source code of the page. He will find the form's tag action is set to form.php. All he have to do is set it as action="http://www.mysite.com/form"... and he may make some additional modification in text area replacement so he may set it back as text-area and then makes its value as he want. These value may be at least some customized HTML tags which may corrupt the look and feel of the page that render the contents.

You should remember that we need rich text editor, but at some customization to control the content appearance.

All he have to do now is hit submit and the data will be inserted or modified. The session does not play any role in this situation because he already registered a session by his first entrance.

I'd like to discuss the rule that $SERVER['HTTP_REFERER'] may play in such situations, suppose this demonstrative code:

// we will use a function to test $_SERVER['HTTP_REFERER']

if (chkRefere($_SERVER['HTTP_REFERER'])){
// returns true
//Ok Do SQL 
}
else{
//print out error and die
}

The chkRefere will use the fact that $SERVER['HTTP_REFERER'] will have blank value if it comes from client computer and also if it comes from another website the refere will not match the website URL i.e It should check the availability of:
http://www.mysite.com at the first of the string value of $SERVER['HTTP_REFERER'] or returns false

What do you think about this technique? Is there anything missing? Is there any way to beat it? or May it produces troubles in the ordinary script execution?

I'm waiting your replies...

NogDog

The $_SERVER['HTTP_REFERER'] variable plays no real role, since (a) not all clients will send it, and (b) it can be easily spoofed by any hacker with half a clue what s/he is doing.

ALL user inputs must be treated as potentially invalid/malicious/harmful, and it is up to you to validate all of them in your server-side scripts to reject any undesirable data.

saidbakr

Do you think that newreply.php of this forum application will not get $_SERVER['HTTP_REFERER'] value as http://www.phpbuilder.com/board/showthread.php?t=10352467
?

I think $_SERVER['HTTP_REFERER'] may only return blank if the post target is new page.

For b) I will be appreciated to know how the attacker fakes $_SERVER['HTTP_REFERER'] ?

NogDog

Any $SERVER array element that begins with "HTTP" comes from the client (browser). Any of them can therefore be spoofed by a hacker, and may not be sent even in perfectly normal usage, often depending upon the browser's security settings and/or the settings of any intervening firewall.

As far as spoofing it, you could do it in a PHP script by sending the post data via a [man]cURL[/man] request, setting the CURLOPT_REFERER value to whatever you want it to be via [man]curl_setopt/man.

Also, I can go into my Firefox browser, type "about:config" in the address bar, filter for "referer", and then muck around with the setting for "network.http.sendRefererHeader".

saidbakr

NogDog wrote:
Any $SERVER array element that begins with "HTTP" comes from the client (browser). Any of them can therefore be spoofed by a hacker, and may not be sent even in perfectly normal usage, often depending upon the browser's security settings and/or the settings of any intervening firewall.

As far as spoofing it, you could do it in a PHP script by sending the post data via a [man]cURL[/man] request, setting the CURLOPT_REFERER value to whatever you want it to be via [man]curl_setopt/man.

Also, I can go into my Firefox browser, type "about:config" in the address bar, filter for "referer", and then muck around with the setting for "network.http.sendRefererHeader".

Well! Well!
From your reply, I can understand that the hacker will be able to only stop sending referer data. This will mean that $_SERVER['HTTP_REFERER'] = ' ' blank and this is all we want because at this situation chkRefere(), that I regarded before, should return false and therefore the query will not be executed.

The real problem we should discuss is divided in two points:

1) Is it probably in normal conditions without hacking or faking $SERVER['HTTP_REFERER'] value to be blank. In other word you and me now when posting replies to newreply.php the $SERVER['HTTP_REFERER'] value is going to be blank?

2)Is this a way for hacker to set his refer to http://www.mysite.com from somewhere like you regarded in FireFox. I noticed that network.http.sendRefererHeader in FireFox settings is integer type and there is any setting value to customize your referer string.

Is my opinion correct?

NogDog

No, a hacker can send any HTTP header that a client can send, including HTTP_REFERER. He can easily set it to the URL of the form page he just copied from your site. So checking for an empty value does not protect you as a hacker will send what looks like a legitimate value, while in the meantime you may get false negatives from perfectly legitimate users who for one reason or another do not send a referer value (browser settings, firewall settings, proxy settings, etc.).

Bottom line: you cannot trust $_SERVER['HTTP_REFERER'] to correctly show that a user has not come from your form page nor to confirm that the user has come from your form page. If you still do not want to believe me and insist on using it, don't blame me if it doesn't stop a hacker while at the same time you get complaints from users who cannot get their form submissions to work.

saidbakr

Ok,
From the PHP manual :

'HTTP_REFERER'
The address of the page (if any) which referred the user agent to the current page. This is set by the user agent. Not all user agents will set this, and some provide the ability to modify HTTP_REFERER as a feature. In short, it cannot really be trusted.

You are right!
Thank you for help.
Oh sorry,
You regarded cURL to do this task? Is there any example please? 🙂

NogDog

I cited cURL as one method for a malicious hacker to send his own form posting with a spoofed HTTP_REFERER header; it would have nothing to do with securing your form, though, if that's what you're asking.

Weedpacket

If I wanted to fake some browser doing something I can if necessary start a telnet session and just type:

open www.phpbuilder.com 80
GET /board/showthread.php?t=10352467
Host: www.phpbuilder.com
User-Agent: Splunge! v4.2
Referer: http://www.example.com/
....etc...

Though I fully expect I'd be more likely to write a program to do it for me.