Beyond what other people mentioned, some sites and frameworks also rely on the Referer header as part of CSRF protection. It's not truly necessary to check, but

Beyond what other people mentioned, some sites and frameworks also rely on the Referer header as part of CSRF protection. It's not truly necessary to check, but it's an OWASP recommendation so it seems like a decent number of places implemented it by default. I recently got the Pyramid Python framework to make it possible to disable Referer-checking for the built-in CSRF protection, but they're still going to keep requiring the header by default: https://github.com/Pylons/pyramid/issues/3508 https://github.com/Pylons/pyramid/issues/3508 More discussion about it in these pull requests too: https://github.com/Pylons/pyramid/pull/3512 https://github.com/Pylons/pyramid/pull/3512 https://github.com/Pylons/pyramid/pull/3518 https://github.com/Pylons/pyramid/pull/3518 The new version with it being optional hasn't been released yet, so as of right now almost everyone using Pyramid will still require users to send a Referer header to get past any CSRF checks.