Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have very little knowledge in application security. I have often seen to protect your application from csrf attacks developers use tokens and pass these tokens with request to validate. I want to know if i just validate the request is coming from my server and rejects all requests coming from any other server how can it be unsafe?

share|improve this question
For further reading, see – msanford Aug 29 '12 at 16:04
up vote 4 down vote accepted

You cannot know where the request is coming from for sure. Sure, you can check the HTTP referer, but that has implications as well.

Many users have set their browsers to not supply the server with the referrer, so you will get rubbish data. If you don't allow empty referrers you will block a lot of legitimate requests. If you allow empty referrers, then all those that have set their browser to not send referrer can be a victim of CSRF.

So rejecting requests based on this will get you nowhere.

Edit: It's called 'HTTP referer', a misspelling of the word referrer.

share|improve this answer
nice one.... i havent heard about this setting in browser.. +1 – Shayan Husaini Jul 12 '12 at 14:03
in firefox you can type about:config in the address field and press enter, then change value of network.http.sendRefererHeader to 0 (2 is default). – Matsemann Jul 12 '12 at 14:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.