in reply to Re^2: Is your web application really secure? ("CSRF")
in thread Is your web application really secure? ("CSRF")

Yes, but I was talking about malicious sites faking referers without the user's explicit permission. If a user wants to forge a referer header there's no way to stop it. Note that we're trying to protect the user, not the web app per se.

"What should it profit a man, if he should win a flame war, yet lose his cool?"
  • Comment on Re^3: Is your web application really secure? ("CSRF")

In Section Meditations