Comment on Faking votes on Hacker NewsparentComments−tlrobinson17yAFAIK, checking the Referer header actually works for preventing CSRF because you can't modify it for the types of requests that work cross domain, i.e. loading <img>, <script>, etc tags, or posting forms.−tptacek17yYour assumption here isn't crazy, but it depends on the browser, and you shouldn't rely on it.
Comments
AFAIK, checking the Referer header actually works for preventing CSRF because you can't modify it for the types of requests that work cross domain, i.e. loading <img>, <script>, etc tags, or posting forms.
Your assumption here isn't crazy, but it depends on the browser, and you shouldn't rely on it.