# CSRF token leak via referer or href

Anti-CSRF token sent to attacker-controlled origin or leaked in Referer to third parties

_Area: Web authentication and account takeover. Seen in 6 disclosed reports; 5 confirmed bounties, median $7,500, range $500-$15,000; latest 2024-06-07. Updated 2026-10-23._

## How it works
An anti-CSRF token only protects a request if it reaches the intended server and nowhere else. This pattern breaks that assumption in two ways: a client-side handler attaches the token to a request whose destination comes from user input (an href, a path parameter), or a privileged token sits in a URL and leaks out in the Referer header to any third party the page contacts. In both cases the token becomes readable by an attacker, who then replays it against the real origin.

## Where to show up
- JS click/submit handlers that read a CSRF token and POST to a link's `href` without checking the target origin [E2](https://bugbountylibrary.com/r/h1%3A47472.md)
- Features that auto-inject a token (e.g. `fb_dtsg`) into a request whose URL is derived from a user-supplied parameter [E1](https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2015-04-bypass-facebook-csrf-html.md)[E4](https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2016-05-how-i-bypassed-facebook-csrf-in-2016-html.md)
- Privileged tokens placed in page URLs (preview, editor, share links) [E3](https://bugbountylibrary.com/r/h1%3A1262434.md)
- Pages making outbound third-party requests (social share, analytics, embeds) with no `Referrer-Policy` set [E3](https://bugbountylibrary.com/r/h1%3A1262434.md)
- Server-side allowlists for token-bearing flows that are not enforced on the server [E4](https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2016-05-how-i-bypassed-facebook-csrf-in-2016-html.md)

## How to review
The invariant: a CSRF token must only ever be transmitted to the origin that issued it. For each handler that attaches a token, trace where the destination URL comes from; if any part is user-controllable, the token can be redirected. Confirm the code compares the target origin to the current origin before sending. For tokens in URLs, check that `Referrer-Policy` (e.g. `no-referrer` or same-origin) is set on every page carrying them, and that outbound third-party requests cannot see the token. Verify any server-side allowlist is actually enforced server-side, not just in the client [E4](https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2016-05-how-i-bypassed-facebook-csrf-in-2016-html.md).

## Variants seen
- Auto-attached token to attacker-controlled `show_dialog_uri` path [E1](https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2015-04-bypass-facebook-csrf-html.md)
- `data-method="post"` handler sending `authenticity_token` to arbitrary href origin [E2](https://bugbountylibrary.com/r/h1%3A47472.md)
- Privileged `oseid` token leaked via Referer to a social sharer, bypassing storefront password [E3](https://bugbountylibrary.com/r/h1%3A1262434.md)
- Continued Flow auto-attaching `fb_dtsg` to attacker-controlled POSTs, with client-only allowlist [E4](https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2016-05-how-i-bypassed-facebook-csrf-in-2016-html.md)

## Why fixes fail
E4 shows the same class recurring a year after E1: the token-minting primitive remained, and the added allowlist was not enforced server-side, so non-whitelisted accounts could still build the forms.

## Impact and severity
Led to authenticated state changes: adding emails, disabling login approvals [E1](https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2015-04-bypass-facebook-csrf-html.md), disabling Timeline Review [E4](https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2016-05-how-i-bypassed-facebook-csrf-in-2016-html.md), forging privileged POSTs [E2](https://bugbountylibrary.com/r/h1%3A47472.md), and storefront password bypass [E3](https://bugbountylibrary.com/r/h1%3A1262434.md). Severity is high because a stolen token defeats the CSRF defense entirely; missing Referrer-Policy and client-only allowlists made it worse.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2015-04-bypass-facebook-csrf-html.md
- E2: https://bugbountylibrary.com/r/h1%3A47472.md
- E3: https://bugbountylibrary.com/r/h1%3A1262434.md
- E4: https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2016-05-how-i-bypassed-facebook-csrf-in-2016-html.md