title: Is just checking the Referer header enough to prevent CSRF?
body: <p>Is comparing the Referer http header enough to prevent CSRF, I have the following html code below.</p>
  
  <pre class="lang-html prettyprint-override"><code>&lt;div id="Message"&gt;&lt;/div&gt;&lt;br&gt;
  Username:&lt;br&gt;
  &lt;input type="text" name="Username" id="Username"&gt;&lt;br&gt;
  Password:&lt;br&gt;
  &lt;input type="password" name="Password" id="Password"&gt;&lt;br&gt;
  Keep me logged in:&lt;br&gt;
  &lt;input type="checkbox" id="KeepSessionAlive"&gt;&lt;br&gt;
  &lt;input type="submit" onClick="ProcessLogin();"&gt;
  &lt;script&gt;
  function ProcessLogin(){
      Username=document.getElementById("Username").value;
      Password=document.getElementById("Password").value;
      KeepSessionAlive=document.getElementById("KeepSessionAlive").value;
      var xmlhttp;
      if (window.XMLHttpRequest){// code for IE7+, Firefox, Chrome, Opera, Safari
              xmlhttp=new XMLHttpRequest();
      }else{// code for IE6, IE5
              xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
      }
      xmlhttp.onreadystatechange=function(){
              if (xmlhttp.readyState==4 &amp;&amp; xmlhttp.status==200){
                      document.getElementById("Message").innerHTML=xmlhttp.responseText;
              }
      }
      xmlhttp.open("POST","/Login/Process",true);
      xmlhttp.setRequestHeader("Content-type","application/x-www-form-urlencoded");
      xmlhttp.send("&lt;A&gt;Username&lt;/A&gt;&lt;B&gt;"+Username+"&lt;/B&gt;&lt;A&gt;Password&lt;/A&gt;&lt;B&gt;"+Password+"&lt;/B&gt;&lt;A&gt;KeepSessionAlive&lt;/A&gt;&lt;B&gt;"+KeepSessionAlive+"&lt;/B&gt;");
  }
  &lt;/script&gt;
  </code></pre>
  
  <p>It is just a standerd html form but I was wondering if I use the code below can I be completely protected from CSRF attacks.</p>
  
  <pre><code>class LoginProcess(webapp2.RequestHandler):
      def post(self):
          self.response.headers['Content-Type'] = 'text/plain'
          HTTTP_REFERER=self.request.referer
          if HTTP_REFER=="http://example.com":
              self.response.write('Referer: '+cgi.escape(HTTTP_REFERER))
  </code></pre>