Cross domain referer leakage, what options are there to prevent it?

Question

Information Security

Based on the results of an external audit, a vulnerability of the type Cross domain referer leakage was found on the project website. I looked at the information on the Internet, but there is only a generalized description of the attack, but I did not find any approaches to its elimination. Can you tell me what can be done on a working site to reduce the risk of this vulnerability?

Answer 1

For example, you have auto-authorization on your site when you go from an email. Type

http://domain.com/[email protected]&secrettoken=vfwervwervwervwervwerv244234

Upon transition, the user will go to the page and if left there, he can click on an external link on the site and go to another site, and in the referer of this request will be

http://domain.com/[email protected]&secrettoken=vfwervwervwervwervwerv244234

To eliminate the vulnerability, it is necessary to intercept with

http://domain.com/[email protected]&secrettoken=vfwervwervwervwervwerv244234

after authorization
Well, https also eliminates this problem