Why was crsf token discovered at the first place? One can always check from the the request generated by origin header

1 Answer 1


"the user agent MAY use the Origin header field to inform the server of the security context in which the script was executing when it caused the user agent to issue the request"

It is not obligatory for a browser to supply the header. In the absence of a valid Origin header, what assumptions should the application make?

"The Origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name"


  • Your suggestion would only provide protection against attacks initiated from other vhosts, not from different applications on the same vhost

  • will cause legitimate requests to fail if the application implements domain sharding

  • requires the application to know the domain it is being served up by

Further, origin support is patchy.

Given that it provides a mechanism for user tracking/de-anonymization without relying on client side persistence, it is unlikely to be viable in the long term as a means of ensuring session integrity.

  • I think the "patchy" status of origin support would be the most persuasive reason. :)
    – Rick
    Aug 9, 2019 at 4:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .