3 ms·
This article is very odd, it frames the change as a third-party/tracking change when it is in fact a (very effective) solution against CSRF attacks. Sites that
by StavrosK 7y ago
This article is very odd, it frames the change as a third-party/tracking change when it is in fact a (very effective) solution against CSRF attacks. Sites that want to track you with third party cookies can simply set SameSite to None and that's that.
This change is 100% for sites that got their cookies sent from other sites by mistake.
More (and accurate) information here: https://www.owasp.org/index.php/SameSite https://www.owasp.org/index.php/SameSite
- red_phone 7y agoAs I understand it, the change makes it easier to identify tracking cookies.
- StavrosK 7y agoBecause you can tell right away if they're third-party cookies and don't need to wait for them to be used in that manner, you mean? That's an interesting (and welcome, to me) side-effect, you're right.