3 ms·
This kills most Cross-Site Request Forgery vulnerabilities, since sites will now need to explicitly opt-in to allowing authentication cookies to be served in cr
by Ajedi32 7y ago
This kills most Cross-Site Request Forgery vulnerabilities, since sites will now need to explicitly opt-in to allowing authentication cookies to be served in cross-site requests.
Of course, it'll probably be a long time before enough browsers support this that you can actually rely on this behavior, and even once support is universal there'll probably still be some sites doing dumb stuff like setting `SameSite=None` on authentication cookies without taking additional precuations, or allowing data to be modified with GET requests. But overall this is a huge win for security on the web.
Previous discussion from back when this was first announced: https://news.ycombinator.com/item?id=19853090 https://news.ycombinator.com/item?id=19853090
- baroffoos 7y ago>it'll probably be a long time before enough browsers support this Will it? All major browsers now receive automatic or timely updates. The speed of features rolling out over all major browsers is pretty rapid now days and unless you care about supporting IE you can expect new features to be ready to use within a year. There is only so much you can do to support users using a discontinued browser many many years out of date. Unless you want to be stuck in 2013 forever you have to let them go eventually.
- Ajedi32 7y agoThe problem is that this is a critical security feature, so the consequences for users are rather severe if you rely on it but their browser doesn't support it. Instead of your site simply being broken or a certain feature on it not working, you'd instead be opening up all users on older browsers to a CSRF attack against your site.