COPY/MOVE should be in the referer filter's default list of protected HTTP methods

The COPY/MOVE method , by default, are not in the list of methods covered by the CSRF Referer filter. This might allow an attacker to copy files (abusing the privileges of a logged in victim) using CSRF.

Note : With proper CORS configuration (such as the default) this issue is mitigated, CSRF is not a problem for COPY/MOVE unless the attacked site has been configured to be wide open for CORS access.