3 ms·
I wouldn't say CSRF is dead yet. Chrome is just one browser, until all major browsers have implemented this (and IE11 is still kicking), you still need to imple
by thayne 7y ago
I wouldn't say CSRF is dead yet. Chrome is just one browser, until all major browsers have implemented this (and IE11 is still kicking), you still need to implement CSRF mitigations as well.
- fulafel 7y agoRe IE11 - https://caniuse.com/#feat=same-site-cookie-attribute https://caniuse.com/#feat=same-site-cookie-attribute says that IE11 supports it on Windows 10. Still leaves W7+IE11 but that's a much smaller (and shrinkin) set of users.