3 ms·The referrer isn't spoofable in any normal browsers (and CSRF attacks occur within the user's browser).by tlrobinson 15y agoThe referrer isn't spoofable in any normal browsers (and CSRF attacks occur within the user's browser).