Support

The HTTP Referer header can be spoofed. Therefore that option would be as good as "None" for all intents and purposes.

The form is not sent because Admin Tools, seeing a different referer compared to the domain, believes I am a spammer.

IMPORTANT!!!!!!!! YOU ARE MAKING FALSE ASSUMPTIONS BECAUSE YOU HAVE NOT READ THE DOCUMENTATION.

ADMIN TOOLS NEVER CHECKS THE REFERER HEADER BECAUSE THIS HEADER CAN BE SPOOFED. I already told you that.

Even if I did not fill in the hidden field. I call it "false positive".

No. It's not what happened and it's NOT a false positive. You have no idea what CSRF is and how CSRFShield protects you EVEN THOUGH I have explained that in the documentation.

Submitting a form MUST ALWAYS CONTAIN THE ANTI-CSRF TOKEN. This is non-negotiable. If you allow forms on your site to be submitted WITHOUT the anti-CSRF token you allow cross site request forgery to take place on your site.

So how do you prevent these CSRF attacks? By injecting the anti-CSRF token in all of the forms and checking for its presence in POST requests, i.e. the Basic mode of CSRFShield. This protects you because the anti-CSRF token is stored in your session and changes on every page load.

So why do you need the advanced mode? Because a more advanced adversary's bot could first do a GET to read the CSRF token and then POST the form - having the same cURL cookie jar in both requests. These bots try to fuzz the contents of all of the fields in a form which is why we have the honeypot field. Once you access it you are telling us that you're a bot which tries to fuzz forms for detecting vulnerable code.

What you call "false positive" is a positive, all right, BUT NOT FALSE. It's a 100% true positive. This is what you asked Admin Tools to do and that's exactly what it does: no CSRF token is present, therefore something is wrong.

It's quite obvious that you want people to be able to fill a form hosted on a random site and submit it on your site without a problem. The only way to do it is setting CSRFShield to None and also be aware that what you are doing is incredibly dangerous from a security perspective. You should NEVER, EVER let forms hosted on random domains post to your site. All of your forms MUST be generated from server side code on your server, include an anti-CSRF token and submitted to server side code which checks the validity of that token.

I reject your feature request because it would give a false sense of security while doing nothing at all. I would much rather be honest and call it the "None" option instead.