5 ms·
> If I want a cookie to be only sent in requests from a page on https://mywebsite.com https://mywebsite.com to https://mywebsite.com/internal/ https://mywebsite
by arkadiyt 6y ago
> If I want a cookie to be only sent in requests from a page on https://mywebsite.com https://mywebsite.com to https://mywebsite.com/internal/ https://mywebsite.com/internal/..., but not from any other origins, should I use Lax or Strict?
Neither setting will do what you want since the flag acts on Sites and not Origins. That is, even in SameSite=Strict mode, requests from subdomain.mywebsite.com will send cookies to mywebsite.com/internal, because they're the same Site.
> If I use HttpOnly cookies and Access-Control-Allow-Credentials=false on https://mywebsite.com/internal/ https://mywebsite.com/internal/..., does that make SameSite irrelevant? Would there be a security risk even if SameSite=None? Is the only security risk related to <img>?
HttpOnly is irrelevant for same-/cross- site/origin discussions - it just means that javascript can't read your cookie. Similarly CORS can only weaken the same origin policy - best to not send it at all. If you want to protect yourself against CSRF attacks on /internal then your best bet is still using standard protections like a double submit cookie or checking the origin/referrer headers. OWASP has a great cheat sheet on it:
https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Re...
- namibj 6y agoIndeed. With https there is no good reason to not have a hard dependency on the origin/referrer header to enforce same-site restrictions.
- bawolff 6y agoEven with https, people can have privacy extensions that mess with referrers. I wouldn't consider referer 100% reliable and origin header isn't always sent for all request types.
- namibj 6y agoBlocking same-site referer beyond stripping the path is something where I'd draw the line to protect the user against CSRF attacks. Do you have any evidence for a modern browser sending a harmful referer or allowing sending of one?
- nulbyte 6y agoFirefox can be configured[1] to never send the header or always send the target URL as the header. [1]: https://wiki.mozilla.org/Security/Referrer https://wiki.mozilla.org/Security/Referrer
- namibj 6y agoInteresting. Especially the latter, considering that even the RFC [0] mentions it's usage for CSRF protection. This seems to be about as harsh as reasonable without breaking CSRF protection: network.http.sendRefererHeader=1 network.http.referer.trimmingPolicy=2 network.http.referer.XOriginPolicy=2 [0]: https://tools.ietf.org/html/rfc7231#section-5.5.2 https://tools.ietf.org/html/rfc7231#section-5.5.2
- bawolff 6y agoSure, but there is a reason why everyone uses tokens to fix csrf and not referrer.