4 ms·

Preventing CSRF attacks: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Checking_the_Referer_Header https://www.owasp.

• tmd83 9y ago
  This. For this you just need the origin though. There's an origin header for 10 years which makes CSRF protection so trivial yet its still not available in all browsers. Firefox can leak referer in regular mode but can't send origin? Not sure. Anyone knows a good document on when/which browser actually sends referer header?
  • throwaway_boi 9y ago
    Firefox and Edge don't send Origin headers with POST requests[0] while all send Referer.[1] 0: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Or... 1: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...