[SECURITY] Validate complete referring request