Securing your API: a modern alternative to CSRF tokens
Why make an extremely complicated set up, with many edge cases, all to save yourself from a single token?<p><pre><code>    - Privacy extensions often times block referrer headers.

    - POST requests are usually necessary.

    - Open redirects are common bugs, and getting your website to initiate one can be a problem.

    - Disabling CORS also relies on you killing crossdomain.xml, which you might overlook.
</code></pre>
Instead you can just roll out CSRF tokens.<p>Having rolled them out myself many times. You probably want to use a library if you aren't a cryptographer or security person:<p><pre><code>    expiration_time_of_1_day || hmac_sha256( secret_key, { expiration_time_of_1_day, user_id })
</code></pre>
I've seen other people mention SameSite cookies, but we aren't near a time when browsers all support them. Don't get fancy preventing CSRF. It's a stupid bug.