Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I understand anti-CSRF tokens to be a chunk of data sent in the response that is expected to match in subsequent requests, but is not stored in cookies. For example, a form with a hidden value that must be included before action is taken on the submit.

The drawback to this is that all the apps and programmers must remember to include this extra token.

I see an alternative solution that allows individual apps to only need to require POST for modifications to data, and their job is done.

To make this work, we simply require all POST requests to have a Referer of the same site.
(not an untrusted site, not a non-https site, and not a blank referer)

Is this solution a complete replacement for anti-CSRF tokens?

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

This is not a solution because common desktop firewalls offer an option to strip the Referer header for privacy reasons.

Furthermore some plugins allow to set the Referer header to arbitrary values, although the common plugins (Java, Flash) prevent this in recent versions.

share|improve this answer
add comment

Adding to @Hendrik answer - to offer a CSRF protection that is tolerated by your users you need to allow requests without Referer header. And it's really easy to make a request from 3rd party websites without this header - for example https:// originated request will have it stripped, also there are various other ways to strip it (disclaimer - it's my research)

You could look at the Origin header which is the "better version of Referer" (not that easy to remove), but it's not yet widely supported by the browsers and is not meant to protect from CSRF. For that you can currently only rely on tokens (even anti-CSRF mechanism based on custom request headers has been bypassed recently).

share|improve this answer
    
What I had in mind was not to permit 'an untrusted site, a non-https site, or a blank referer'. (see above) (in case it is not clear, this is an https service to begin with) But your information is useful none-the-less. –  George Bailey Jan 11 '12 at 19:46
1  
@GeorgeBailey Which is a good decision from a security point of view, but will quickly turn into a usability problem for your users, so it's rarely used in real life. –  Krzysztof Kotowicz Jan 11 '12 at 22:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.