16003 - secure forms requesting "refering URL" not working

Status: VERIFIED DUPLICATE of bug 1582

(Core :: DOM: Core & HTML, defect, P3)

Description

[holi]

When I go to http://shadnet.shad.ca, and login with my ID and password (when a
wrong password or ID is entered, you get a wrong username/pswd error, which is
normal and working right) in Mozilla, I get this error:

""""""
ShadNet -- Your refering URL is not allowed.

For security reasons, pages in ShadNet may only be linked to by other pages in
ShadNet. This is especially important when performing FORM processing.

If you are interested in more details, please contact the system administrator
[[e-mail]] for more information
""""""

I'm using M10 right now, but have noticed the problem on every other previous
nightly builts and releases I used, starting from M3. I'm on Win98, but I am 99%
sure that the problem persists for every other platforms and OSs.

I won't give you my username&pswd for obvious reasons, but I asked the admin and
he made a test page that should normally show the refering URL when one is
provided. Look to: [http://dev.shad.ca/~odin/blah.html]. Netscape 4.61 will
display: "Content-Type: text/html You were referred by:
http://dev.shad.ca/~odin/blah.html" while Mozilla won't display anything.

Comment 1

[Mark Welch]

This is a referer bug. Reassigning to warren so that he can assign to the proper
person.

Comment 2

[Warren Harris]

Doug and Gagan should handle this.

Comment 3

[Doug Turner (:dougt)]

the url listed above is no longer valid.

Comment 4

[holi]

Sorry about that, the admin did a CVS update and it nuked it. The url
[http://dev.shad.ca/~odin/blah.html] is back online now.

Comment 5

[Gagan]

Seems like form submission has broken referer sending. I recall having added
that myself. So am taking over and going to investigate...

My first hunch is that we are using all lower case headers which for some
scripts is bad, even though the spec says its valid. But I am going to hold back
my comments on it till I can figure out whats going on here.

Comment 6

[chris hofmann]

m12

Comment 7

[leger]

Moving Assignee from gagan to warren since he is away.

Comment 8

[Warren Harris]

Moving what's not done for M12 to M13.

Comment 9

[Warren Harris]

Back to Gagan for m13.

Comment 10

[leger]

Setting the keyword all open [4.xp] bugs to 4xp.

Comment 11

[Sitsofe Wheeler]

I think this is a dup of bug 1582 - Send HTTP_REFERER value to server. Marking
as such.

*** This bug has been marked as a duplicate of 1582 ***

Comment 12

[John Unruh]

Verified duplicate.