Anti-CSRF mechanism with referer header

Question

This is not my main anti-CSRF mechanism; I know that https requests don't have a referer header; I know users or firewalls can remove it or set to an arbitrary fixed value.

I intend this mechanism just as a possible added security layer preventing CSRF in case my main mechanism is bypassed for some reason.

My code will be something like this:

if(isset($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST']))
if(parse_url($_SERVER['HTTP_REFERER'], PHP_URL_HOST)!=$_SERVER['HTTP_HOST'])
exit('Anti-CSRF mechanism!');

I think this has no support and usability problems. right?

Answer 1

Although checking the HTTP referer header is a method of mitigating CSRF, this proposed PHP implementation is bypassed by omitting the referer, which can be done using a meta referer policy. If the CSRF exploit originates from an HTTPS site then the referer will be absent, and this absent case is not checked for in the above code. The lack of a referer should be considered an attack. However, a much better anti-csrf method is using a synchronization token.

Answer 2

There are ways to lose CSRF mitigations using Referer at HTTP. Practical demonstration could be accessed here: http://attacker.kotowicz.net/lose-referer/test.php#

Quoting bypasses from above link:

Bypasses: GET requests

data: with location= - Chrome / Safari
window.open() - MSIE
data: with meta refresh - Firefox / Opera / Chrome / Safari 

POST requests

data: with meta refresh & form submit - Firefox / Chrome / Safari

A better option could be Origin or NoRefferer.