I have a website with a lot of CSRF issues and fixing them using CSRF token will take a lot of work. So , my question is : can I block POST requests based on referer header using .htaccess ? For example this request should be allowed:
POST http://mywebsite.com/password
REFERER: http://mywebsite.com/
pass=xxxx
but this one should be blocked.
POST http://mywebsite.com/password
REFERER: http://evil.com/
pass=xxxx
also , and how to block POST requests with no REFERER header ?
Thanks in advance.
curl --referer forgedRefererValue http://www.your.website.com
it's that easy to set a referer header