In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host header?

I'm asking because I'm trying to make my application ready for proxies. Load balancers on public networks are one of the many possible use cases, but local SSL/TLS wrapper is more urgent as we need to test WebCrypto API usages in secure contexts.


According to OWASP Cheatsheets, both are fine. I would object checking X-Forwarded-Host, as it's not a forbidden header.

You can do the following check, and it will be compatible in most cases: ( $Origin or $Referer ) == ( $Host or %ServerName% )

As for the load balancer part, if you're considering deploying a commercial CDN for your application, the following configuration may be usable (it's based on Apache HTTPD, other servers would have different config directives):

UseCanonicalName on
<VirtualHost *:*>
  ServerName app01.example.com
  ServerAlias app01.source.example.com
</VirtualHost *:*>

And configure the DNS servers to resolve app01.example.com to the CDN, and point the CDN to app01.source.example.com. This way, when an HTTP request arrives at your server, Origin/Referer will match ServerName in your server-side CSRF defense codes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.