5 ms·
Disabling cross site cookies breaks many sites.
by sodality2 6y ago
Disabling cross site cookies breaks many sites.
- enriquto 6y agosounds like a desirable feature to me
- sodality2 6y agoAgreed, that's why I use it!
- candiddevmike 6y agoIt's a shame because local storage and friends aren't quite as secure (no way to block all JS from accessing it like you can with cookies).
- gruez 6y agoIs this really an issue? If the attacker has XSS on your site you're already screwed because they can manipulate the DOM to simulate user actions.
- staticassertion 6y agoIt means they can't exfiltrate the cookie, which I think is a pretty nice win, even if they can still perform requests to the domain with that cookie. For one thing it means they're locked to my session.
- isbvhodnvemrwvn 6y agoHow would they steal HTTP-only cookies this way?
- minitech 6y agoThey wouldn’t steal the cookie, they’d just have the script send the requests as the user directly.
- mvolfik 6y agoWhat would be the point of localstorage if JS couldn't access it? Cookies can be set and get via http headers, but is localstorage available by other means than JS?
- ficklepickle 6y agoNo, it is only accessible from JS. Parent comment does not make sense. By that logic, we should turn off our computers to improve security.
- marshmallow_12 6y agowhy?
- sodality2 6y agoGood question. third party login sites mostly don't keep me logged in, kick me out, doesn't let me log in, etc.
- kiwijamo 6y agoGive us some real concrete examples. This does not match my experience at all so I'm dubious.
- sodality2 6y agoI have trouble with google login (url must be copied into a google tab) and oracle cloud loses my tenancy home region every few minutes (https://i.imgur.com/ZCsepq3.png https://i.imgur.com/ZCsepq3.png). Several other examples like LMS's that use O365 to log in must be manually logged in every time
- driverdan 6y agoNo it does not. I've had 3rd party cookies disabled for as long as I can remember. I've found less than five sites that had issues.
- sodality2 6y agoI guess we use different sites then. I should specify I mean it doesn't keep me logged in. I consider this breaking because if I click a link to that site, it loses the original context once logged in.
- adrr 6y agoIt's going to break all 3rd party social layer providers. Most news sites don't have native comments and rely on a 3rd party like a Disqus. Login in state is stored as a cookie. It also going to break all the openID stuff that is heavily used in organizations like Walmart. OpenID is all based around cookies. I remember having to rebuild our provider when Safari released an update that you can't set 3rd party cookies without user interaction.
- aczerepinski 6y agoWhat did you do instead? Redirects?
- kreeben 6y ago>> It's going to break all 3rd party social layer providers Good. Disqus had it too easy. >> It also going to break [..] Good. They had it too easy. I'm absolutely loving the fact that my switch to Firefox is paying off. Finally!
- adrr 6y agoThat type of attitude toward the millions of users that use discus just shows why Firefox is a dying browser with ever decreasing install base. Funding will keep decreasing as it is tied to search engine deals which is based in active users.
- abdullahkhalids 6y agoThe only sites that really break are organizational websites, which you can whitelist anyway.