title: Is it a good practice to check referer in the server-side form submission handler?
body: <p>I am doing a Java web site. I hope to make the web site safer. </p>
  
  <p>In my web site, all the forms are supposed (by design) to be opened in a page through a GET link from my website. I hope to check whether the referer is my web site in my server-side form submission handler. The idea is to avoid taking data from attacker-locally-generated form submission. </p>
  
  <p>I feel that the key to this approach is whether the referer the server detects  is reliable. </p>
  
  <p>I understand that there are other ways to improve security. Let's just focus on the approach in my post.</p>
  
  <p>Thanks for any input!</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>Specifically, I am doing a Spring MVC web site. I am using an interceptor to examine all traffic, especially the form submission.</p>