I don't think that HTTP headers are enough and feel that setting csrf tokens is the best approach to this. My reasoning behind this is that there are a lot of p

I don't think that HTTP headers are enough and feel that setting csrf tokens is the best approach to this. My reasoning behind this is that there are a lot of privacy plugins[1] that people use that interfere with the headers and using referer header is even worse because a lot of websites have redirection vulnerabilities eg if you want to be returned to the page you were at after logging into a website the url would be something like login.php?url=/page/id , a lot of websites do not sanatize this which would render this useless. It is also not an option for some websites that must have a function like this, a prime example of this is Youtube[2] which uses csrf token (hidden fields) in forms to mitigate this issue. [1] - http://www.ghostery.com http://www.ghostery.com [2] - http://www.youtube.com/redirect?q=http://youtube.com/page http://www.youtube.com/redirect?q=http://youtube.com/page