Will checking origin and referer headers for CSRF protection block valid requests?

Question

If the origin and referer header check per the OWASP CSRF cheat sheet is followed, will valid requests be blocked (ignoring the token part of the recommendation for this question)? I've seen some references to the fact that such headers are not always sent so if requests are blocked if neither is present, then perhaps valid requests are being blocked. Is this considered a real issue?

Additional edit: The requests I am trying to check are only those that change the state (database) of the site. I would not allow $_GET requests to change the state. I would not apply the header check against $_GET requests that do not change the site.

Answer 1

This depends on what you consider valid requests. If you expect all requests to be caused by navigation inside your web application then it will work unless you explicitly request that the Referer does not get send or if the user uses some kind of Referer blocking (browser extension or configuration). But, if you consider requests valid which come from accessing a bookmark in the browser or a link inside a mail then these will cause problems because no Referer or Origin will be sent.

EDIT: since according to the updated question your application does not expect GET requests to be state changing and thus you don't check these for CSRF bookmarks and links inside a mail should not be a problem and thus you can expect the Referer and/or Origin to be sent with each state changing request.