> Cross-site request forgery. Example: Accepting requests with an Origin header from a different domain English is not my first language and I’m not a security

> Cross-site request forgery. Example: Accepting requests with an Origin header from a different domain English is not my first language and I’m not a security expert, but this description seems a bit misleading. The “Origin header” part should be left out. You don’t check where it’s comming from (you can’t know). You either send a unique token back and forth, or you defer the issue to the browser (cookies with Same Site strict/lax). And it’s not “requests”, it’s “unsafe requests” AKA mutations (POST, PUT, PATCH, DELETE). It’s not just a nitpick. If your GETs are not safe, you might cause deeper issues.