Safety
Origin vs Referer Headers for CSRF Defense
December 26, 2024
Origin vs Referer for CSRF defense is a metadata choice, not a token replacement. The Origin header carries scheme-host-port without a path. The Referer (legacy spelling) can include the full URL — which is a leak — and privacy tools omit it more often. For cookie-authenticated state changes, prefer verifying Origin against an allowlist, keep SameSite=Lax or Strict, and still use CSRF tokens for defense in depth. Do not treat a missing Referer as proof of evil; some browsers send Origin on POSTs and little else. RoastMyOpsec does not submit cross-site forms. It grades Set-Cookie SameSite on the landing response. Confirm Origin checks in the app.
The practical difference
Origin is purpose-built for 'which site started this.' Referer is a navigation leftover. Referrer-Policy that strips the Referer does not remove Origin on the requests that still send it. Checking only Referer fights your own privacy header.
SameSite reduces a class of cross-site cookie attachment. Origin checks reject unexpected callers even when SameSite is None for an embed cookie. See SameSite=None vs Lax and CSRF tokens vs SameSite.
How to choose based on the form
Same-origin cookie POSTs: CSRF token plus Origin allowlist matching your site (and www vs apex — pick one canonical host). Cross-origin APIs with cookies: that is CORS credentials, not a Referer check. GET-only navigation should not change state, so Origin-on-GET is not your CSRF plan.
| Signal | Contains path? | Often missing? | Takeaway |
|---|---|---|---|
| Origin | No | Less often on POSTs | Prefer for CSRF allowlists |
| Referer | Yes, unless policy strips it | Yes, with strict Referrer-Policy | Do not rely on it alone |
| CSRF token | N/A | If the form omitted it | Still ship it |
| SameSite Lax/Strict | N/A | If you set None | Layer, not the only lock |
What the roast can see
Cookie flags, not your Origin middleware. A clean SameSite grade is not proof POSTs check Origin. Pair with www vs apex so the allowlist matches the canonical host.
Common mistakes
The first mistake is Referer-only checks plus Referrer-Policy: no-referrer.
The second mistake is allowing a null Origin as 'same-site.'
The third mistake is skipping tokens because SameSite exists.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is Origin better than Referer for CSRF?
- Yes as a site identifier. Still use CSRF tokens and SameSite. Do not use Referer as the only check.
- Does RoastMyOpsec test CSRF?
- No. No cross-site POSTs, no exploit payloads. It reads public Set-Cookie and headers.
- Should I allow a missing Origin?
- For cookie POSTs, fail closed or use another control (token). Do not treat absence as same-origin.