I understand anti-CSRF tokens to be a chunk of data sent in the response that is expected to match in subsequent requests, but is not stored in cookies. For example, a form with a hidden value that must be included before action is taken on the submit.
The drawback to this is that all the apps and programmers must remember to include this extra token.
I see an alternative solution that allows individual apps to only need to require POST for modifications to data, and their job is done.
To make this work, we simply require all POST requests to have a Referer of the same site.
(not an untrusted site, not a non-https site, and not a blank referer)
Is this solution a complete replacement for anti-CSRF tokens?