[HughParry]

Presumably just throwing a 403 if they have this referrer is ok and won't have a weird SEO impact or something?

[jsheard]

Couldn't the attacker evade that by sending Referrer-Policy: no-referrer with their redirect?

[HughParry]

Good shout. Can always block based on origin header though (when under the assumption that it's a legit browser) since it's a forbidden header name.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Or...

[RajBhai]

Sounds like a security flaw that browsers honor this.

[thiago_fm]

No, and the earlier you do the better.

Later it might have