Is it a good practice to check referer in the server-side form submission handler?

Question

I am doing a Java web site. I hope to make the web site safer.

In my web site, all the forms are supposed (by design) to be opened in a page through a GET link from my website. I hope to check whether the referer is my web site in my server-side form submission handler. The idea is to avoid taking data from attacker-locally-generated form submission.

I feel that the key to this approach is whether the referer the server detects is reliable.

I understand that there are other ways to improve security. Let's just focus on the approach in my post.

Thanks for any input!

UPDATE

Specifically, I am doing a Spring MVC web site. I am using an interceptor to examine all traffic, especially the form submission.

Answer 1

No, it is not reliable. Some browsers may allow removing the referrer, or might not send it at all. And a naughty person can easily just add the referrer to the requests, so by itself it will not give any extra security except from random people trying random things.