I think he means that with Origin header supported in all major browsers for 5+ years, the csrf_token offered by Plug.CSRFProtection is no longer necessary. You still need to check Origin header to see if it match your expectation but that can be done in 2 lines of code.
2 Likes
