2 ms·
The Origin HTTP header[0] is the fix for CSRF. It's been plagued initially be slow adoption and later by inconsistent support like the example in this article
by lucideer 6y ago
The Origin HTTP header[0] is the fix for CSRF.
It's been plagued initially be slow adoption and later by inconsistent support like the example in this article and others[1], but as a general spec. it should fix CSRF if implemented consistently and correctly by browser vendors.
[0] https://tools.ietf.org/html/rfc6454#section-7 https://tools.ietf.org/html/rfc6454#section-7
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1508661 https://bugzilla.mozilla.org/show_bug.cgi?id=1508661