Comment on Faking votes on Hacker NewsparentComments−tptacek17yReferer is totally insecure.If all it is is votes, I say the right solution is "let it go".−tlrobinson17yAFAIK, checking the Referer header actually works for preventing CSRF because you can't modify it for the types of requests that work cross domain, i.e. loading <img>, <script>, etc tags, or posting forms.−tptacek17yYour assumption here isn't crazy, but it depends on the browser, and you shouldn't rely on it.
Comments
Referer is totally insecure.
If all it is is votes, I say the right solution is "let it go".
AFAIK, checking the Referer header actually works for preventing CSRF because you can't modify it for the types of requests that work cross domain, i.e. loading <img>, <script>, etc tags, or posting forms.
Your assumption here isn't crazy, but it depends on the browser, and you shouldn't rely on it.