Question

I need to ensure that the user login form for Drupal can not be signed into when the referrer is from a remote domain. It is a security vulnerability which impacts enterprise acceptance.

The path is: https://domain.com/user

There is currently a rule in place at the end of .htaccess to require https access

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

I looked at this to see how the rule might identify the url, but do not know how I would take that and implement it with the referrer and not impact the other rules for https

Answer 1

# if referer not empty
RewriteCond %{HTTP_REFERER} !^$
# and referer doesn't contain domain.com
RewriteCond %{HTTP_REFERER} !domain\.com
# and it is a POST request
RewriteCond %{REQUEST_METHOD} POST [NC]
# than redirect to current url to remove the POST data and show the default login screen
RewriteRule ^(user)$ /$1 [R=302,L]