TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Issue: Bitbucket relies on the Referer HTTP header

71 点作者 whyagaindavid超过 8 年前

7 条评论

Analemma_超过 8 年前
Seems fairly clear that this is a Django issue, not a Bitbucket issue. Maybe change this link to point to the equivalent Django bug: <a href="https:&#x2F;&#x2F;code.djangoproject.com&#x2F;ticket&#x2F;16870" rel="nofollow">https:&#x2F;&#x2F;code.djangoproject.com&#x2F;ticket&#x2F;16870</a>.
评论 #13302092 未加载
评论 #13302175 未加载
评论 #13304443 未加载
hedora超过 8 年前
Does anyone know of a good alternative to the atlassian suite? Given their price structure and popularity, I&#x27;d expect them to fix stuff like this in a timely fashion, and fix some basic UI issues.<p>Bitbucket server (aka &quot;stash&quot;) examples:<p>- Create a pull request (the most common workflow in bitbucket) takes far too many page loads, and is buried in &quot;hamburger&quot;&#x2F;&quot;more options&quot;<p>- For teams with per-developer repos, it does not remember which repos the currently logged in user frequently uses, so you scroll through everone on the team&#x27;s name for most operations. (And the new version &quot;improved&quot; this in some places with a JavaScript-heavy list that renders like molasses on no-gpu xeon vms).<p>- Each product (bitbucket, jira, confluence) uses a different markup language.<p>And so on. I could complain about other workflows or other products, but this is pretty typical for their stuff.
评论 #13305225 未加载
评论 #13302601 未加载
评论 #13302363 未加载
评论 #13303326 未加载
评论 #13302587 未加载
MrBuddyCasino超过 8 年前
Relying on the referrer header for CSRF protection is dubious at best. Just use a token like everybody else, protect against session fixation, call it a day.
评论 #13302110 未加载
评论 #13302473 未加载
unknownsavage超过 8 年前
I really don&#x27;t think this is a big deal. I run a medium size website with well over 2000 uniques users per day and also require the referer header to use the website. So far, I&#x27;ve yet to receive a single complaint or find a browser that doesn&#x27;t send it.<p>It might be optional as per the spec, but it&#x27;s completely ubiquitous at this point, and provides an easy way to add an extra layer of safety for web developers.
marcosdumay超过 8 年前
Well, you should not post from HTTP to HTTPS anyway.<p>I highly doubt there is any good reason to do it anywhere, and on the one case you think you got a good reason (I still doubt it), don&#x27;t try to anonymize the hell out of a logged-on request.
评论 #13301880 未加载
i386超过 8 年前
How dare Bitbucket have a bug in their code while the rest of us live and breath standards compliant perfection?
bsusuabw超过 8 年前
Twitter does this. If you filter all referrers, all Ajax requests fail (even posting something).