title: What is PHP's session.referer_check protecting me from?
body: <p>I'm making a system with CakePHP that needs to be decently secure, because we're dealing with money, customer's accounts, etc. So far everything's been working great, until I've had to integrate with a payments platform in which I need to redirect to their site and they redirect back to mine. </p>
  
  <p>This works fine in my dev machine (debug = 2), but in production, when the customer is redirected back, he gets a login prompt instead of landing back in his "logged in area". After much digging I found this is because CakePHP sets session.referer_check, which invalidates sessions if the HTTP_REFERER comes from another host than mine.</p>
  
  <p>Now, normally, i'd disable this without a second thought, but in this system i'm a bit more concerned about security than normal.</p>
  
  <p>My question is what exactly is session.referer_check supposed to protect me from?<br>
  What kind of attack/exploit/bad thing can be done to my site if I turn it off?</p>
  
  <p>I'm guessing that there's gotta be some reason why this exists, but I can't imagine what it'd protect me from. </p>
  
  <p>Could you give me any ideas?<br>
  Is it safe disabling this?</p>
  
  <p>Thank you<br>
  Daniel</p>