diff --git a/assembly/src/release/webapps/api/WEB-INF/classes/jolokia-access.xml b/assembly/src/release/webapps/api/WEB-INF/classes/jolokia-access.xml
index 09f29a494e..8cad1cd40e 100644
--- a/assembly/src/release/webapps/api/WEB-INF/classes/jolokia-access.xml
+++ b/assembly/src/release/webapps/api/WEB-INF/classes/jolokia-access.xml
@@ -17,6 +17,11 @@
 -->
 <restrict>
 
+  <!-- Enforce that an Origin/Referer header is present to prevent CSRF -->
+  <cors>
+    <strict-checking/>
+  </cors>
+
   <!-- deny calling operations or getting attributes from these mbeans -->
   <deny>
     <mbean>
@@ -31,4 +36,4 @@
     </mbean>
   </deny>
 
-</restrict>
\ No newline at end of file
+</restrict>