3 ms·

The referer header can easily be forged. The whole point of a CSRF attack is to turn a user's credentials against him.

• eurleif 15y ago
  How do you forge the referer header as a third-party site?
  • sdevlin 15y ago
    Ha, I'm wrong. I thought you could set the referer with setRequestHeader on an XHR. Mea maxima culpa.