In a CSRF defense based on checking forbidden headers, should I check
Referer header against the
ServerName configuration directive, or is it sufficient to simply check against the HTTP
I'm asking because I'm trying to make my application ready for proxies. Load balancers on public networks are one of the many possible use cases, but local SSL/TLS wrapper is more urgent as we need to test WebCrypto API usages in secure contexts.