add csrf tokens to forms.

[dave b.]

So while checking the REFERER is ok in most situations. It may be possible spoof the REFERER.
If an attacker can spoof the REFERER they can can potentially post to a url like https://launchpad.net/~USERNAME/+editsshkeys and add their ssh key.
Really, csrf tokens should be added to forms.

[0] - https://answers.launchpad.net/launchpad/+faq/1024
[1] - http://www.cgisecurity.com/csrf-faq.html

[Robert Collins (lifeless)]

Specifically http://www.cgisecurity.com/csrf-faq.html#referer seems relevant.

[Robert Collins (lifeless)]

We have a nonce system for oauth; extending that to forms should be totally doable without big infrastructure.

[William Grant (wgrant)]

All known Referer spoofing vulnerabilities are long-fixed, and there are far worse old browser holes that could be exploited.

However, it's still fragile since lots of people block the header. CSRF tokens should be added.