On the Perils of Leaking Referrers in Online Collaboration Services

摘要: Online collaboration services (OCS) are appealing since they provide ease of access to resources and the ability collaborate on shared files. Documents these frequently via secret links, which allows easy between different users. The security this link approach relies fact that only those who know location resource (i.e., its URL) can it. In paper, we show OCS files be leaked by improper handling links embedded in Specifically, if a user clicks into file hosted an OCS, HTTP Referer contained resulting request might leak URL. We present study 21 online seven them vulnerable kind information disclosure caused Referers. identify two root causes issues, both having do with incorrect application Referrer Policy, countermeasure designed restrict how Referers third parties. first case, six their referrers because not implement strict enough up-to-date policy. second one service correctly implements appropriate but some web browsers obey it, causing clicked through To fix problem, discuss apply Policy avoid incidents, as well other server client side countermeasures.