Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to verify the submit request is coming from within the same application/domain/approved URLs?
Another way to think about this is if you drop the referer header check and are checking something that verifies its coming from a known source. What are the implications of not checking the form data source?
Specifically in a passive scenario, e.g. purely browser based.
The biggest implication I see is that I can submit the credentials from another site and log in successfully.
But what risks are there in this? I realize it depends on each application and the threat models for it, but can this be generalized?