Have you read the discussion on security.stackexchange.com ?
there's no decrease in availability by an attacker (there's only a self inflicted denial by the user)
there's also no decrease in confidentiality for the service itself (and if the user uses an appropriate extension[0], or the browsers implement an appropriate whitelist mechanism, there's no confidentiality decrease for the user in general either)
This is simply defense in depth
If you leaked the SECRET_KEY/misconfigured the CSRF creation (which should be impossible, but it's the whole point of adding layers) AND the victim is being MITM AND you don't implement HSTS AND You correctly set cookies as Secure
You would have a potential vulnerability, exploitable (only?) via CSRF, which this check prevents
there's no decrease in availability by an attacker (there's only a self inflicted denial by the user)
there's also no decrease in confidentiality for the service itself (and if the user uses an appropriate extension[0], or the browsers implement an appropriate whitelist mechanism, there's no confidentiality decrease for the user in general either)
This is simply defense in depth
If you leaked the SECRET_KEY/misconfigured the CSRF creation (which should be impossible, but it's the whole point of adding layers) AND the victim is being MITM AND you don't implement HSTS AND You correctly set cookies as Secure
You would have a potential vulnerability, exploitable (only?) via CSRF, which this check prevents
[0] like https://addons.mozilla.org/en-US/firefox/addon/smart-referer... but I'm not advocating for the use of this extension