CHIBA / Plack-Middleware-RefererCheck-0.03 / README 

            

              
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

              
NAME
    Plack::Middleware::RefererCheck - check referer for defensive CSRF
    attack.(DEPRECATED)
SYNOPSIS
      use Plack::Builder;
      builder {
          enable 'RefererCheck', host => 'www.example.com', same_scheme => 1, error_app => sub { [403, [], ['Forbidden']] };
          $app;
      };
  
      or more simply(host from $env->{HTTP_HOST} and same_scheme => 0)
      # this is vulnerabilly for DNS Rebinding
      builder {
          enable 'RefererCheck';
          $app;
      };
DESCRIPTION
    Please note that this module has been DEPRECATED.
    Because Referer is not required and RFC2616 strongly recommends that the
    user be able to select whether or not the field.
    Please use other way. For example Plack::Middleware::CSRFBlock,
    Catalyst::Controller::RequestToken and Amon2::Plugin::Web::CSRFDefender.
CONFIGURATION
    host
        Instead of using $env->{HTTP_HOST} if you set.
    same_scheme
        Check if you are setting "1" the same scheme.default: "0"
    error_app
        Is an PSGI-app that runs on errors.default: return 403 Forbidden
        app.
    no_warn
        mute DEPRECATED warnings.
AUTHOR
    Masahiro Chiba
LICENSE
    This library is free software; you can redistribute it and/or modify it
    under the same terms as Perl itself.
SEE ALSO
    Plack::Middleware Plack::Builder