Don't be so condescending, you didn't read my entire post. To quote myself: > POST (and restricting to same-origin) I still don't think it's possible to for

Don't be so condescending, you didn't read my entire post. To quote myself: > POST (and restricting to same-origin) I still don't think it's possible to forge the referer header on an uncompromised browser.