Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently, I found that I was failing to log into certain websites using Firefox. Not sure when exactly it started happening. Right now, I'm running Firefox 14.0.1. Logins work fine on other browsers.

The most recent time gave me the most descriptive error.

Forbidden (403)

CSRF verification failed. Request aborted.

You are seeing this message because this HTTPS site requires a 'Referer header'
to be sent by your Web browser, but none was sent. This header is required for
security reasons, to ensure that your browser is not being hijacked by third 

If you have configured your browser to disable 'Referer' headers, please 
re-enable them, at least for this site, or for HTTPS connections, or for 
'same-origin' requests.

This led me to finding an answer to my problem in another question. In about:config, "network.http.sendRefererHeader" was set to "0". I changed the setting to "1", and was then able to log in successfully. I don't remember setting this myself, so I wonder if a default setting was changed during an update.

My question, is there a reason why referer headers should be disabled? Is it a security thing?

share|improve this question
up vote 1 down vote accepted

The HTTP_REFERER header string identifies the URL you were "on" when you clicked a link and caused your browser to issue another HTTP request. This can be considered a privacy violation. Many sites insist this header string is set correctly as a bit of a defense against machine-generated requests and hotlinking.

You may have a security-conscious add on that may be causing Firefox to not send this header or send bogus data in it.

share|improve this answer
I think you may be right on the "security-conscious addon". I'm using the Web Developer Toolbar. There is an option to "disable referers" that seems to toggle "network.http.sendRefererHeader". The gotcha is that it does not indicate whether it's enabled or not. Thanks for the tip on what to look for. – dangowans Aug 14 '12 at 18:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .