Is checking the referrer enough to protect against a cross site request forgery attack? I know the referrer can be spoofed, but is there any way for the attacker to do that
Among other things, using the referrer won't work for users whose browsers (or corporate proxies) don't send referrers.