4 ms·
If I understand well. If the user is not using a browser that respect this new policy an attack can occur. Even if 99% of my users have a browser that support S
by edgartaor 10y ago
If I understand well. If the user is not using a browser that respect this new policy an attack can occur.
Even if 99% of my users have a browser that support SameSite cookies. 1% of the users are still vulnerable. A bank app can not afford that kind of risk.
So CSRF is not dead after all.
edit: Typo
- naasking 10y agoI don't know, at some point not supporting this feature would be equivalent to a running a browser with a flawed TLS implementation. The burden is on the user to keep their software up to date.
- edgartaor 10y agoYep. >at some point In the meantime, I think it's better mitigate this kind of danger at the server side.