Web Security · Middle · Question 25 of 75

How can checking the `Origin` header help against CSRF?

1Because the Origin header contains the user's password
✓Correct answer: Browsers set it on cross-site POSTs, so the server can reject state-changing requests from unknown origins
3Because attackers can't send requests without cookies

Explanation

Browser JavaScript can't forge Origin. Treat a missing header carefully, and combine the check with SameSite cookies or tokens.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.