I have a static site which has forms. The forms submit to a Rails endpoint which captures the submitted data. The static site and the Rails endpoint are on the same domain, on different subdomains and all traffic is completely on HTTPS.
I understand how Rails CSRF works for server generated forms. But in my case, these forms are on static HTML pages. I understand all request headers can be faked, so can't rely on that.
If a strong solution is not possible for this scenario then my last option would be to move to server generated forms (which I want to avoid for now).
Any suggestions on a good approach to this would be most welcome. Or any pointers to a system or a library which already does this.
I could implement a REFERER check on the HTTPS POST request (in my case) - is that enough ? Can that not be spoofed ?
The CSRF prevention cheat cheat sheet says: Although it is trivial to spoof the referer header on your own browser, it is impossible to do so in a CSRF attack. - I don't quite understand this.
Any help would be much appreciated.