CSRF tokens are used a lot.
But why not simply check the Origin header? According to OWASP, that's why it exists:
The Origin HTTP Header standard was introduced as a method of defending against CSRF and other Cross-Domain attacks.
"Is the Origin not there? If not, OK. If it is, is it one one I trust (e.g. the same origin)? If so, OK."
CSRF tokens can be troublesome. They are
- more difficult for beginners to understand -- "Wait...I send it twice? What's CRSF again?"
- requires cookies (granted, not usually a problem)
- more difficult to implement -- needs controller and view
- less flexible -- can't ever work cross-domain
- strange in non-web settings -- "Why does your API need a CSRF token?" "Oh, 'cause JS uses that too."
- more cumbersome to implement globally -- "Oops, forgot the CSRF tag here among my 25 HTML form fields"
Given these disadvantages, why are CSRF tokens so commonly used, rather than the Origin header?