title: Is checking the referrer enough to protect against a CSRF attack?
body: <p>Is checking the referrer enough to protect against a cross site request forgery attack? I know the referrer can be spoofed, but is there any way for the attacker to do that FOR the client? I know tokens are the norm, but would this work?</p>