I understand anti-CSRF tokens to be a chunk of data sent in the response that is expected to match in subsequent requests, but is not stored in cookies. For example, a form with a hidden value that must be included before action is taken on the submit.

The drawback to this is that all the apps and programmers must remember to include this extra token.

I see an alternative solution that allows individual apps to only need to require POST for modifications to data, and their job is done.

To make this work, we simply require all POST requests to have a Referer of the same site.
(not an untrusted site, not a non-https site, and not a blank referer)

Is this solution a complete replacement for anti-CSRF tokens?

2 Answers 2


This is not a solution because common desktop firewalls offer an option to strip the Referer header for privacy reasons.

Furthermore some plugins allow to set the Referer header to arbitrary values, although the common plugins (Java, Flash) prevent this in recent versions.


Adding to @Hendrik answer - to offer a CSRF protection that is tolerated by your users you need to allow requests without Referer header. And it's really easy to make a request from 3rd party websites without this header - for example https:// originated request will have it stripped, also there are various other ways to strip it (disclaimer - it's my research)

You could look at the Origin header which is the "better version of Referer" (not that easy to remove), but it's not yet widely supported by the browsers and is not meant to protect from CSRF. For that you can currently only rely on tokens (even anti-CSRF mechanism based on custom request headers has been bypassed recently).

  • What I had in mind was not to permit 'an untrusted site, a non-https site, or a blank referer'. (see above) (in case it is not clear, this is an https service to begin with) But your information is useful none-the-less. Commented Jan 11, 2012 at 19:46
  • 1
    @GeorgeBailey Which is a good decision from a security point of view, but will quickly turn into a usability problem for your users, so it's rarely used in real life. Commented Jan 11, 2012 at 22:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .