Re:Show HN: This up votes itself
by danielrm26 on Thursday March 22, 2012 @10:08PM
(#3743253)
The referer header is also controlled by the client. Anything controlled by the client should be considered tainted.
[ Parent
| on HN ]
This doesn't really apply when you are trying to verify whether the client actually performed some action.
In a CSRF scenario, the client itself can presumably be "trusted" - A client behaving maliciously can only hurt itself, not any one else. The important thing is to not trust anything that may have been provided by a third party.