Rule Definition
Developers may assume that inputs such as cookies, environment variables, and hidden form fields cannot be modified. However, an attacker could change these inputs using customized clients or other attacks. This change might not be detected. When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the software. Without sufficient encryption, integrity checking, or other mechanism, any input that originates from an outsider cannot be trusted. The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.

Remediation
Use of referer in HTTP request header field is not recommended.

Violation Code Sample

public class MyServlet extends HttpServlet { 
  protected void doPost(HttpServletRequest request, HttpServletResponse response) 
        throws ServletException, IOException { 
    String referer = request.getHeader("referer"); // VIOLATION 
    if(isTrustedReferer(referer)){ 
      //.. 
    } 
    //... 
  } 
}

Fixed Code Sample

public class MyServlet extends HttpServlet { 
  protected void doPost(HttpServletRequest request, HttpServletResponse response) 
        throws ServletException, IOException { 
    String referer = request.getHeader(headerName); // VIOLATION FIXED
    //...
  } 
}

http://cwe.mitre.org/data/definitions/293 http://cwe.mitre.org/data/definitions/807 OWASP 2017 Category A2 - Broken Authentication