Can CSRF be prevented by implementing referrer checking?
No. Referer headers can be spoofed using XMLHTTP and by using flash as demonstrated by Amit Klein and rapid7 and therefore cannot be trusted. Has a vulnerability in a major site been discovered? A vulnerability in GMail was discovered in January 2007 which allowed a attacker to steal a GMail user’s contact list. A different issue was discovered in Netflix which allowed an attacker to change the name and address on the account, as well as add movies to the rental queue etc…
