How about asserting that the referrer must have at least a matching origin, or better yet path? I don’t immediately know of any sane configurations that strip

How about asserting that the referrer must have at least a matching origin, or better yet path? I don’t immediately know of any sane configurations that strip a same-origin referrer, but that would cause every request to be blocked as cross-site. Spoofing a third-party referrer to same-origin is rare, but occasionally done (I think uMatrix defaults to doing that). And unfortunately, it looks like Firefox at least (the only one I’ve checked) includes a trailing slash on third-party referrers rather than only including the origin (that is, it sends `Referer: https://example.com/ https://example.com/` for different-origin requests rather than `Referer: https://example.com https://example.com` like I hoped), so you can’t completely reliably distinguish between an actual first-party request of /, and a spoofed third-party request. But if you’re OK blacklisting the root path, it’d work. (Actually, what about the Origin header? I’m a little rusty on current statuses and usages of the Origin and Referer headers; haven’t been doing loginny HTTP for a few years. Can’t remember how old the Origin header is, either. But is there some reason you’re not just going for it?)