Remove referrer check on backend login
Browser vendors are considering or have already announced not to send the
Referer (which is part of the HTTP) when links are followed or forms are submitted. Due to the fact that TYPO3 requires the Referer URL when logging into the backend or working in the backend, this move will possibly lock out users of modern browsers.
Affected TYPO3 Versions¶
- TYPO3 version 7.x → affected
- TYPO3 version 8.x → affected
- TYPO3 version 9.x → affected
Remove referrer check on backend login in TYPO3. TYPO3 should not rely on or require the
Referer header sent by the browser, when a user logs into the backend.
Alternatively, site administrators can disable the check already (see below). However, this should become the default.
[SYS][doNotCheckReferer] = 1
Firefox version 59 obscures Referrer to strengthen user's privacy (German):
Mozilla announces to remove path information from referrers in Firefox 59:
Electronic Frontier Foundation (EFF) discovered this leak of personal health data:
Updated by Helmut Hummel over 3 years ago
Since the referrer check was some poor mans CSRF protection,
which we now replaced with CSRF protection tokens for every backend action,
the referrer check became obsolete.
We can safely remove it in master and deactivate (or evan also remove it) in released bramches.