A quick fix against CSRF is to check the Referer
and/or Origin
HTTP header. At least one of these should be set and the domain it contains should be your domain (i.e. same origin).
Note that this will break cases where your site is accessed from a bookmark, link inside a mail or similar since in thus cases no Referer
will be sent. But in no case you should simply accept an empty Referer
(unless you have a non-empty Origin
header) since this is easy to create for an attacker.
You should also make sure that your checks for the domain are correct. This is, if your site is www.example.com
you must not accept Referer
like http://www.example.com.attacker.com
or http://www.attacker.com/www.example.com
or http://www-example.com
.
You should also make sure that the attacker can not use other functionality (or bugs) in your application as a trampoline to create a custom request with malicious payload but the expected same-origin Referer
. As Arminius nicely pointed out in a comment, open redirects might be such a trampoline. Thus you should either make sure that all requests to the domain have a same-origin Referer
or that any parts which might need to accept a cross-origin Referer
can not be abused as trampoline.
For more information about this method of protecting against CSRF and about its potential problems see Verifying Same Origin with Standard Headers in the Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet from OWASP.