Edit Question - KnowledgeHub

Title Body

I'm making a system with CakePHP that needs to be decently secure, because we're dealing with money, customer's accounts, etc. So far everything's been working great, until I've had to integrate with a payments platform in which I need to redirect to their site and they redirect back to mine. This works fine in my dev machine (debug = 2), but in production, when the customer is redirected back, he gets a login prompt instead of landing back in his "logged in area". After much digging I found this is because CakePHP sets session.referer_check, which invalidates sessions if the HTTP_REFERER comes from another host than mine. Now, normally, i'd disable this without a second thought, but in this system i'm a bit more concerned about security than normal. My question is what exactly is session.referer_check supposed to protect me from? What kind of attack/exploit/bad thing can be done to my site if I turn it off? I'm guessing that there's gotta be some reason why this exists, but I can't imagine what it'd protect me from. Could you give me any ideas? Is it safe disabling this? Thank you Daniel

Tags (comma-separated) Cancel