[Date Prev][Date Next][Thread Prev][Thread Next][Minivend by date
][Minivend by thread
]
Re: [mv] Could this be a possible Security Hole?
> The best way around this that I know is to check the HTTP_REFERER and make
> sure the page actually resides on your site before doing anything critical
> (like checkout).
A lot of browsers now allow users to disable the HTTP_REFERER
variable (and it's spoofable anyhow). If you decide to use it anyway,
you may want to display a message telling people who don't have this
environment setting why things aren't working for them.
Chris
