OWASP Guidance: prefer Origin header over Referer header when Identifying Source Origin

[gsmethells]

CSRF protection in csrf.py should prefer Origin header over Referer header if the former is available when checking same_site().

• OWASP Guidance on the topic

[gsmethells]

The current code

       if request.is_secure and current_app.config['WTF_CSRF_SSL_STRICT']:
            if not request.referrer:
                self._error_response('The referrer header is missing.')

            good_referrer = f'https://{request.host}/'

            if not same_origin(request.referrer, good_referrer):
                self._error_response('The referrer does not match the host.')

only looks at request.referrer.

[gsmethells]

Broken off from #364