title: Cross Site Request Forgery prevention via 'Referer' header
body: <p>We recently received result from IBM AppScan DAST and some of the result don't make much senses.</p>
  
  <blockquote>
    <p><strong>2.Medium -- Cross-Site Request Forgery</strong>    </p>
    
    <p>Risk(s): It may be possible to steal or manipulate customer session and cookies, which might be used to impersonate a legitimate
    user, allowing the hacker to view or alter user records, and to perform transactions as that user
    Fix: Validate the value of the "Referer" header, and use a one-time-nonce for each submitted form</p>
    
    <p>The following changes were applied to the original request:</p>
    
    <blockquote>
      <p>Set header to '<a href="http://bogus.referer.ibm.com" rel="nofollow noreferrer">http://bogus.referer.ibm.com</a>'</p>
    </blockquote>
    
    <p>Reasoning:</p>
    
    <p>The test result seems to indicate a vulnerability because the Test Response is identical to the 
    Original Response, indicating that the Cross-Site Request Forgery attempt was successful, even
    though it included a fictive 'Referer' header.</p>
    
    <p>Request/Response:</p>
  
  <pre><code>POST /**/main.xhtml HTTP/1.1 -- **This xhtml only opens a default menu on page load**
  User-Agent: Mozilla/4.0 (compatible; MS
  </code></pre>
    
    <p>The recommend fix </p>
    
    <blockquote>
      <p>Validate the value of the "Referer" header, and use a one-time-nonce for each submitted form.</p>
    </blockquote>
  </blockquote>
  
  <p>javax.faces.ViewState has an implicit CSRF protection.</p>
  
  <p><a href="https://www.beyondjava.net/jsf-viewstate-and-csrf-hacker-attacks" rel="nofollow noreferrer">https://www.beyondjava.net/jsf-viewstate-and-csrf-hacker-attacks</a></p>
  
  <p>I could also do explicit CSRF protection using protected-views. This explicit CSRF protection adds a token for all cases, and additionally adds checks for the “referer” and “origin” HTTP headers. (Reference Bauke &amp; Arjan Book Definitive Guide)</p>
  
  <p>The report also marks /javax.faces.resource/ like CSS , JS , fonts which i believe are false positive in the report. </p>
  
  <p>Looking for feedback and some insight.</p>