title: How to decline malicious requests
body: <p>I recently took over an application and we recently did an appscan and I got a item marked as vulnerable.  The remediation task the report suggested was to Decline malicious requests.  The report said appscan tried:</p>
  
  <blockquote>
    <p>The following changes were applied to the original request: Set HTTP header to '<a href="http://bogus.referer.ibm.com" rel="nofollow">http://bogus.referer.ibm.com</a>'</p>
  </blockquote>
  
  <p>I had this flagged the 1st time we ran appscan, and put code to check if the urlreferer is provided, if so then make sure it's the same as the host in the url, otherwise kill the user's session and redirect to the login page.  We ran appscan again and it got flagged again, I'm not sure how to handle this.</p>
  
  <p>When I look at the report, it shows it put in bogus referrer, the server responded with a 302 status, redirect, and then a request was put in for the login which the server responded with a 202, giving it.  Appscan reasoning says: </p>
  
  <blockquote>
    <p>The same request was sent twice in different sessions and the same response was received.
    This shows that none of the parameters are dynamic (session identifiers are sent only in
    cookies) and therefore that the application is vulnerable to this issue.</p>
  </blockquote>
  
  <p>But wouldn't the response always be the same?  If the check fails a 302 followed by a 202, a redirect and login page comes up, regardless of the user.  Does anyone know how to handle this?  I'm guessing I could put the user's session id into the redirect url so appscan will see if as different, but I thought there must be another way.</p>
  
  <p>This is a .net 4 application.  Users are tracked with the Session object, if that matters, Forms Authentication was not used.</p>