Referer based CSRF Check

rf.py

        param = self.request.get("ch10")
        referer = self.request.referer
        xreferer = self.request.headers.get('X-Referer')
        domain = "pentesteracademylab.appspot.com"
        domain1 = domain2 = ''
        if referer:
            domain1 = referer.replace('http://', '').split('/')[0]

        if xreferer:
            domain2 = str(xreferer).replace('http://', '').split('/')[0]

            if param == flag and domain1 == domain and domain2 == domain :
                cid = "success"
                self.response.headers.add_header("Set-Cookie", "cid-csrf10="+cid)
                self.redirect("/lab/webapp/csrf/10")
                return