Task #83768
Updated by Michael Schams almost 7 years ago
h2. Issue Browser vendors are considering or have already announced *not* to send the @Referer@ (which is part of the HTTP) when links are followed or forms are submitted. Due to the fact that TYPO3 requires the Referer URL when logging into the backend or working in the backend, this move will possibly lock out users of modern browsers. h2. Affected TYPO3 Versions * TYPO3 version 7.x → *affected* * TYPO3 version 8.x → *affected* (_not tested, see comments below_) * TYPO3 version 9.x → *affected* (_not tested, see comments below_) h2. Solution Remove referrer check on backend login in TYPO3. TYPO3 should not rely on or require the @Referer@ header sent by the browser, when a user logs into the backend. Alternatively, site administrators can disable the check already (see below). However, this should become the default. <pre> [SYS][doNotCheckReferer] = 1 </pre> h2. References: Firefox version 59 obscures Referrer to strengthen user's privacy (German): https://www.heise.de/newsticker/meldung/Firefox-59-verschleiert-Referrer-fuer-besseren-Datenschutz-3960175.html Mozilla announces to remove path information from referrers in Firefox 59: https://blog.mozilla.org/security/2018/01/31/preventing-data-leaks-by-stripping-path-information-in-http-referrers/ Electronic Frontier Foundation (EFF) discovered this leak of personal health data: https://www.eff.org/deeplinks/2015/01/healthcare.gov-sends-personal-data