title: How is it impossible to spoof Referer Header during CSRF Attack?
body: <p>Suppose that an application's only defense against CSRF Attacks is to check the referer header for the same origin. Suppose, also, that all browsers will be sending the referer header (although this isn't always the case).</p>
  
  <p>I read that it is trivial for a user to spoof his own referer header, but that it is <a href="https://stackoverflow.com/questions/1413930/is-checking-the-referrer-enough-to-protect-against-a-csrf-attack">IMPOSSIBLE</a> for a CSRF attacker to do the same. </p>
  
  <p>1.) How do you spoof a referer header? (Note, referer headers can't be <a href="https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name" rel="nofollow noreferrer">modified</a> programmatically)</p>
  
  <p>2.) Why can't a CSRF attacker do that?</p>