in src/main/java/org/apache/sling/security/impl/ReferrerFilter.java [453:462]
private boolean isValidUriReferrer(HostInfo hostInfo) {
for (final URL ref : this.allowedUriReferrers) {
if (hostInfo.host.equals(ref.getHost()) && hostInfo.scheme.equals(ref.getProtocol())) {
if (ref.getPort() == 0 || hostInfo.port == ref.getPort()) {
return true;
}
}
}
return false;
}