CWE-293
Using Referer Field for Authentication
The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.
Impactr finds and proves whether CWE-293 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.