Weirdly for me Atlassian doesn't work when I have the spoof referrer enabled in about:config. Like why does referrer, a property that is a header, define whether my login is valid or not?
Here's a reference to a F5 device providing SAML SSO services and having a similar issue:
https://www.devcentral.f5.com/s/question/0D51T00007npfjw/chr...
> since we cannot discount the possibility of malicious users programatically generating tokens and forcing them upon users, we check the referer header to ensure that the request chain was initiated in the one place that we're comfortable with: id.atlassian.com
Make of that what you will.