Example - 1

The following code samples check a packet's referer in order to decide whether or not an inbound request is from a trusted host.

openNewSecureSession(requestPacket);n = read(newsock, buffer, BUFSIZE);requestPacket = processPacket(buffer, n);if (requestPacket.referer == trustedReferer){}String trustedReferer = "http://www.example.com/"while(true){}

openPrivilegedConnection(request);return true;

sendPrivilegeError(request);return false;String referer = request.getHeader("referer")String trustedReferer = "http://www.example.com/"if(referer.equals(trustedReferer)){}else{}boolean processConnectionRequest(HttpServletRequest request){}

These examples check if a request is from a trusted referer before responding to a request, but the code only verifies the referer name as stored in the request packet. An attacker can spoof the referer, thus impersonating a trusted client.