Of course, you realize referrer-spoofing is trivial. If this check were actually necessary, some form of user authentication is the answer.

I've got good news, and I've got bad news:
The universe is merely a figment of my imagination.
Now are you ready for the bad news?

Perhaps you should generate a token in your forms and check to see if the token is valid on submit.

Hi,

will this work even the POST was sent using Curl - where it's also possible to set the referrer?

[ akosiloibe ]