16 ms·
> The first check you can make is to verify that a request’s origin and referer headers match the location of the website. These headers can’t be programmatical
by interfixus 8y ago
> The first check you can make is to verify that a request’s origin and referer headers match the location of the website. These headers can’t be programmatically set
Can I stop reading right here? The referer header is presumably the oftenest spoofed header on the planet.
- Cpoll 8y agoThis isn't to defend against a malicious user crafting requests, it's to defend against a malicious site tricking the user's browser into making an authenticated request. Said malicious site can't set those headers. Edit: I think I misread your comment and you're not arguing that checking origin/referrer isn't enough for security, but rather that it will block legitimate, privacy-conscious users. Using a CSRF token is a valid alternative, and it's mentioned just below in the article.