3 ms·
This is good news I think. Devs often just don’t know or pay attention to stuff like XSRF in my experience as a professional developer. It’s not something you
by javagram 7y ago
This is good news I think. Devs often just don’t know or pay attention to stuff like XSRF in my experience as a professional developer.
It’s not something you notice until your site gets hacked. Or if you do notice it, it’s in a security audit at the end of development and the ticket to fix it might get buried in a backlog below the features and bugs users actually see and want.
Having the protection on by default is the only way to solve this for good, it’s how cookies always should have been.
Turning cookies to same site by default will definitely break a lot of things though. I implemented SameSite cookie functionality in a library at work and we had several issues with it breaking stuff and confusing people when they updated to the new secure version of the library.