A pair of researchers from Qualys are proposing a new header-based browser policy to combat Cross-Site Request Forgery (CSRF) attacks. CSRF tokens are frequently used insecurely if at all. They say the new policy could be a much simpler, and more broadly effective means of countering CSRF attack techniques. The new policy they propose is Session Origin Policy (SOS), which they say could affect a much easier way to combat CSRF attacks than a CSRF token approach.”]
Source: https://informationsecuritybuzz.com/news/can-we-end-csrf-with-header-based-browser-policies/