frank1 has asked for the wisdom of the Perl Monks concerning the following question:

Am having a problem from my script. this is the error am getting Forbidden (403) CSRF verification failed. Request aborted. You are seeing this message because this HTTPS site requires a “Referer header” to be sent by your Web browser, but none was sent. This header is required for security reasons, to ensure that your browser is not being hijacked by third parties.

#!/usr/bin/perl use lib '.'; use strict; use warnings; use HTTP::Tiny; use JSON; use LWP::UserAgent; my $ua = LWP::UserAgent->new( ssl_opts => { verify_hostname => 0 }, ); $ua->agent("MyApp/0.1"); my $referer = $ENV{HTTP_REFERER}; my $callback = ""; my $address = ""; my $pending = "1"; my $confirmations = "1"; my $email = ''; my $json = "1"; my $post = "0"; my $priority = "default"; my $multi_token = "0"; my $convert = "0"; my $req = HTTP::Request->new(POST=>"https://link?callback=$callback&ad +dress=$address&pending=$pending&confirmations=$confirmations&email=$e +mail &post=$post&json=$json&priority=$priority&multi_token=$multi_token&con +vert=$convert"); $req->referer($referer); my $Response_Req = $ua->request($req); if($Response_Req->is_success){ print $Response_Req->content ."\n"; } else{ print "Error: " . $Response_Req->status_line; }

Replies are listed 'Best First'.
Re: Referer header
by haj (Vicar) on Jul 09, 2024 at 13:20 UTC

    Blame the person or piece of code who is responsible to provide a valid URL in the environment variable HTTP_REFERER. It does not happen in the script as we see it!

      even if i use a valid url in my $referer = 'from_my_url'

      it does not work

Re: Referer header
by Anonymous Monk on Jul 09, 2024 at 19:11 UTC
Re: Referer header
by sectokia (Friar) on Jul 10, 2024 at 04:32 UTC

    You need to get this working in a browser so you can use webtools to review what is going on. Most likely you are meant to request a login/verification page where you will be given a cookie and may have to login. You then need to specify that cookie in the headers of your request.