Why make an extremely complicated set up, with many edge cases, all to save yourself from a single token?
- Privacy extensions often times block referrer headers.
- POST requests are usually necessary.
- Open redirects are common bugs, and getting your website to initiate one can be a problem.
- Disabling CORS also relies on you killing crossdomain.xml, which you might overlook.
Instead you can just roll out CSRF tokens.
Having rolled them out myself many times. You probably want to use a library if you aren't a cryptographer or security person:
expiration_time_of_1_day || hmac_sha256( secret_key, { expiration_time_of_1_day, user_id })
I've seen other people mention SameSite cookies, but we aren't near a time when browsers all support them. Don't get fancy preventing CSRF. It's a stupid bug.
Having rolled them out myself many times. You probably want to use a library if you aren't a cryptographer or security person:
I've seen other people mention SameSite cookies, but we aren't near a time when browsers all support them. Don't get fancy preventing CSRF. It's a stupid bug.