3 ms·
Is a SameSite=Strict cookie sent if VICTIM.COM does a redirect? If so, it sounds like the next trick to follow would be a type of "redirect gadget" to get Same
by rob-olmos 7y ago
Is a SameSite=Strict cookie sent if VICTIM.COM does a redirect?
If so, it sounds like the next trick to follow would be a type of "redirect gadget" to get SameSite=Strict to be exploitable again. If so, maybe it's only the end of CSRFs without a gadget.
Eg of "redirect gadget", CSRF via VICTIM.COM/open-redirect?url=/update-password...