I have researching CSRF and one thing on the list, I feel is questionable. I am not sure if "checking the referrer" is worth doing or not.
Some articles I read, are saying something of this nature:
However, this is risky, as some corporate proxies strip the referrer from all HTTP requests as an anonymization feature. You would end up potentially blocking legitimate users.
Other articles I'm reading say you should do it and consider an empty referrer as an attack.
My website does deal with multiple corporations and if its true that a corporations proxy can omit the referrer then I find it being a problem then an actual benefit to the website.