plone/plone.protect — comment on commit c35239511d5b86129fecf9805178913ceec3700a
File:  line 0
By vangheem:

Not really. From what I understand, this is what other frameworks do for their csrf protection. From the django dev csrf section, "In addition, for HTTPS requests, strict referer checking is done by CsrfViewMiddleware. This is necessary to address a Man-In-The-Middle attack that is possible under HTTPS when using a session independent nonce, due to the fact that HTTP 'Set-Cookie' headers are (unfortunately) accepted by clients that are talking to a site under HTTPS. (Referer checking is not done for HTTP requests because the presence of the Referer header is not reliable enough under HTTP.)"

Or if someone has figured out the key used for the csrf token, this prevents an attacker creating a malicious form that posts from another website.