3 ms·
"It's probably worth reading through https://github.com/w3c/resource-timing/issues/64 https://github.com/w3c/resource-timing/issues/64 and the proposal I linked
by gcp 10y ago
"It's probably worth reading through https://github.com/w3c/resource-timing/issues/64 https://github.com/w3c/resource-timing/issues/64 and the proposal I linked above. In short, it's not clear that implementing the Origin header the way Chrome supports it actually helps with CSRF and it makes it harder (impossible really) to distinguish CORS requests."
Seems Firefox will implement it anyway because it's still better than nothing.
- steffenweber 10y agoThe conclusion of this discussion seems to be that "SameSite" cookies should be used to help preventing CSRF. https://www.igvita.com/2016/08/26/stop-cross-site-timing-attacks-with-samesite-cookies/ https://www.igvita.com/2016/08/26/stop-cross-site-timing-att...