In the OWASP CSRF guidelines (https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet) their number one "no brainer" recommendation for CSRF protection is to validate that the origin header matches the current request origin.
However, I've noticed ASP.NET MVC 4.0 doesn't seem to do this by default (note: I haven't tested Web API yet; this is just plain MVC controllers)
Is there a good reason this isn't enabled by default? Is there a built-in feature I can simply just tu on or do I have to roll-my-own? if I do implement origin checking, are there any caveats I might have missed?
I appreciate that you can't trust headers if the browser has been compromised, but OWASP point out (quite reasonably IMO) that if the attacker has already compromised the browser, they're unlikely to need a CSRF attack.
I haven't included sample code here, but basically I just built two simple web sites, one of which contains a form and the other posts to that form.