3 ms·
What we really want is a failsafe way of setting cookies: i.e. a way of setting cookies that won't work on browsers without SameSite support. Otherwise this sol
by jasonhansel 7y ago
What we really want is a failsafe way of setting cookies: i.e. a way of setting cookies that won't work on browsers without SameSite support. Otherwise this solution will still leave a security hole for the many users not on (the latest version of) Chrome.
Ideally we could do this by intentionally making the SameSite cookie syntax non-backwards-compatible.
- feanaro 7y agoSo... Break the web for anyone not on the latest version of Chrome?
- jasonhansel 7y agoNo, just give devs the ability to easily catch the error & use an alternative, secure solution.
- lighthazard 7y ago"easily"
- javagram 7y agoIf there were an easy, alternative secure solution then developers would already be using it. Implementing common anti-XSRF mechanisms like a session token in a form field or extra http header requires modifying every place your app communicates with the server. It’s anything but easy which is why so many apps/websites not built with XSRF in mind still have vulnerabilities.