allowed-referers

Edit online

Use the allowed-referers stanza entry to specify which referrers can request management pages.

Syntax

allowed-referers = referer_filter

Description

For protection against cross-site request forgery (CSRF) attacks, you can configure WebSEAL to validate the HTTP Request referer header for all account management pages. WebSEAL uses the value that is provided for this configuration entry to determine whether the referrer host name in an incoming request is "valid".

If this entry is configured, when WebSEAL receives a request for an account management page, WebSEAL:
  1. Checks whether the referer header is present in the HTTP Request header.
  2. Validates the host name portion of that referrer against the allowed-referers entries.
If WebSEAL finds that an incoming request does not match any of the configured allowed-referers filters, the request fails and WebSEAL returns an error page.
Entries can contain the following wildcard characters:
  • * - match 0 or more characters.
  • ? - match any single character.
  • \ - Literal match of the following character.

You can use the value %HOST% for this entry. This value is a special filter, which indicates to WebSEAL that a referrer is "valid" if the host name portion of the referer header matches the host header.

If there are no allowed-referers entries then WebSEAL does not complete this validation.

Note: You can specify this entry multiple times to define multiple "allowed" referrer filters. WebSEAL uses all of these entries to validate the referrer.

For more information about referrer validation, search for "CSRF" in the IBM Verify Identity Access: Web Reverse Proxy Configuration Guide.

Options

referer_filter
Specifies a filter for a referrer host name that WebSEAL can accept as "valid".

Usage

This stanza entry is optional.

Default value

None.

Example

The following entry matches any referrer host name that begins with the characters ac, followed by zero or more characters, and ends with the characters me. 
allowed-referers = ac*me

The following entry indicates that a referrer is "valid" if the host name portion of the referer header matches the host header.

allowed-referers = %HOST%