OWASP has a great set of recommendations for dealing with CSRF:
You can use only an Origin and Referer check for CSRF protection without any other measures, if in the rare case that you receive neither header, you simply block the request. It was common once for users to spoof or disable the sending of Referer headers for privacy reasons, and older browsers may not send the Origin header. This probably doesn't really matter in 2017, but it depends on your needs.
You need to be able to extract the relevant info of the origin (eg hostname) from either header (which can include a full Referer header) and compare it with your target origin in a robust way.
I feel that a double-submit cookie (eg randomly generated token and cookie each time) may be simpler to implement.