rack-protection-remote-referrer.html

<dl class="rdoc-list note-list"><dt>Prevented attack
<dd>
<p>CSRF</p>
</dd><dt>Supported browsers
<dd>
<p>all</p>
</dd><dt>More infos
<dd>
<p><a
href="http://en.wikipedia.org/wiki/Cross-site_request_forgery">en.wikipedia.org/wiki/Cross-site_request_forgery</a></p>
</dd></dl>

<p>Does not accept unsafe HTTP requests if the Referer [sic] header is set to
a different host.</p>