Compatibility of the "Origin" http header for enforcing restrictions
browser, http, json, rest, security
Solution
Here's a list of compatible browsers and known issues. Now it's up to you if you can live with these limitations:
Can I use...
Problem
I am building a RESTful JSON api and I am concerned about json data theft and Cross-Site Request Forgery. A good solution that was created to address both of these problems is the Origin http header. However I am concerned that this method isn't compatible with all modern browsers. Is this a valid concern? Is the Origin http header useless due to compatibility problems? Should the origin ever be considered when performing an HTTP referer check?