> The discussion is about preventing the users machine being "attacked" > unknowingly. A user faking a referer themselves isn't going to be a problem, > as not only would they be authorizing the action, but they'd be going out of > their way to make sure it got through. Read up on the first post to see what > this discussion is actually about. Popular software that strips out Referer headers is utilised by many users. They're not faking the Referer, but they're certainly not sending it. So, again, relying on that header for pretty much anything is not much of an idea. jason
This archive was generated by hypermail 2b30 : Mon Jun 18 2001 - 22:47:40 PDT