3 ms·

Yes. Now I got it. It does(can be) prevent if CSRF happens. Since Referer header is not sent by all the browsers, Origin can be used. - http://people.mozilla.or

by arunoda 14y ago

Yes. Now I got it. It does(can be) prevent if CSRF happens. Since Referer header is not sent by all the browsers, Origin can be used. - http://people.mozilla.org/~bsterne/content-security-policy/origin-header-proposal.html http://people.mozilla.org/~bsterne/content-security-policy/o...