HTTP Referer #565
Description
- Add an explanation in the documentation
- Users must not fake their HTTP Referer to use the POST forms of FreshRSS, for security reasons, at least for the time being [Sécurité] Vulnérabilité de type CSRF pour changer le password #554
- OWASP
- http://fr.wikipedia.org/wiki/R%C3%A9f%C3%A9rant
- http://en.wikipedia.org/wiki/HTTP_referer
- Add a test in install.php to warn users who might have altered their HTTP Referer (e.g. [bug] javascript refresh is looping #564)