This question already has an answer here:
SOP (same origin policy) provides some security for the users against some attacks, but it is not very strict as it still allows you to send GET and POST requests from a different origin that APIs by default process and send a response. This leaves some room for CSRF attacks.
We are building an API with a sole responsibility to serve our own SPA (Single Page Application, like Angular, React, etc...). There are some easy techniques to defend against CSRF, but I came up with a much simpler one and would like to hear some opinions whether it makes sense.
I am proposing to implement API side validation, to check whether the origin is whitelisted and if not, ignore the request completely. Are there any drawbacks for such a solution?