anti-CSRF tokens vs Referer and POST testing

Question

I understand anti-CSRF tokens to be a chunk of data sent in the response that is expected to match in subsequent requests, but is not stored in cookies. For example, a form with a hidden value that must be included before action is taken on the submit.

The drawback to this is that all the apps and programmers must remember to include this extra token.

I see an alternative solution that allows individual apps to only need to require POST for modifications to data, and their job is done.

To make this work, we simply require all POST requests to have a Referer of the same site.
(not an untrusted site, not a non-https site, and not a blank referer)

Is this solution a complete replacement for anti-CSRF tokens?

Answer 1

This is not a solution because common desktop firewalls offer an option to strip the Referer header for privacy reasons.

Furthermore some plugins allow to set the Referer header to arbitrary values, although the common plugins (Java, Flash) prevent this in recent versions.

Answer 2

Adding to @Hendrik answer - to offer a CSRF protection that is tolerated by your users you need to allow requests without Referer header. And it's really easy to make a request from 3rd party websites without this header - for example https:// originated request will have it stripped, also there are various other ways to strip it (disclaimer - it's my research)

You could look at the Origin header which is the "better version of Referer" (not that easy to remove), but it's not yet widely supported by the browsers and is not meant to protect from CSRF. For that you can currently only rely on tokens (even anti-CSRF mechanism based on custom request headers has been bypassed recently).