If the origin and referer header check per the OWASP CSRF cheat sheet is followed, will valid requests be blocked (ignoring the token part of the recommendation for this question)? I've seen some references to the fact that such headers are not always sent so if requests are blocked if neither is present, then perhaps valid requests are being blocked. Is this considered a real issue?

Additional edit: The requests I am trying to check are only those that change the state (database) of the site. I would not allow $_GET requests to change the state. I would not apply the header check against $_GET requests that do not change the site.

  • that's a possibility, but likely not a problem. the referrer is most commonly omitted when navigating sites or loading off-site images, which are not issues for you. still, if you use tokens, it seems that requiring a token is a lot more important and assuring than a variable header.
    – dandavis
    Commented Jun 6, 2017 at 9:34
  • Regarding the importance of the token, OWASP emphasizes the header check and considers the token "an additional precaution to really make sure". Seems like they consider the header check to be primary?
    – lindon
    Commented Jun 6, 2017 at 10:00
  • you can do "1 strike and you're out", which honestly works 99/100 times. if you do want to allow some requests w/o those headers, you need a token. if you don't care about supporting the edge cases (eg. IE11 w/CORS), you can get by without even using tokens...
    – dandavis
    Commented Jun 6, 2017 at 10:07
  • See also In what cases will HTTP_REFERER be empty
    – Sjoerd
    Commented Jun 6, 2017 at 10:13
  • @dandavis - okay, sounds like it would work except for edge cases. The OWASP recommendation is a "1 strike and you're out" test as they recommend blocking if the header check doesn't work before moving on to the token.
    – lindon
    Commented Jun 6, 2017 at 10:24

1 Answer 1


This depends on what you consider valid requests. If you expect all requests to be caused by navigation inside your web application then it will work unless you explicitly request that the Referer does not get send or if the user uses some kind of Referer blocking (browser extension or configuration). But, if you consider requests valid which come from accessing a bookmark in the browser or a link inside a mail then these will cause problems because no Referer or Origin will be sent.

EDIT: since according to the updated question your application does not expect GET requests to be state changing and thus you don't check these for CSRF bookmarks and links inside a mail should not be a problem and thus you can expect the Referer and/or Origin to be sent with each state changing request.

  • Good point on needing to explain what requests I'm applying the check to - please see edited question above.
    – lindon
    Commented Jun 6, 2017 at 11:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .