3 ms·

This is good information, and I'd love to see a write up how Firefox, Chrome, Brave and other browsers can be set up to prevent some of this. For example, Fire

This is good information, and I'd love to see a write up how Firefox, Chrome, Brave and other browsers can be set up to prevent some of this. For example, Firefox has both first-party isolation mode and now Total Cookie Protection, which isolates cookies and would thus likely prevent CSRF. However, I think first-party isolation causes CORS issues like when trying to pay with Paypal on another retail site.

kevin_thibedeau 5y ago
> However, I think first-party isolation causes CORS issues like when trying to pay with Paypal on another retail site. Generate URLs with a time limited token as query param. No cookies needed.
cmeacham98 5y ago
> which isolates cookies and would thus likely prevent CSRF CSRF is often done via redirecting you or submitting a form, both of which obviously completely bypass FPI and dFPI (i.e. the cookie part of Total Cookie Protection). > I'd love to see a write up how Firefox, Chrome, Brave and other browsers can be set up to prevent some of this. I only use firefox, you'll have to find information elsewhere for other browsers. CSRF, XSS, Set-Cookie Need to be fixed server-side, there is little to nothing you can do as the client. CSRF and XSS represent straight-up vulnerabilities in the website. Report to the developer and/or stop using the vulnerable website. CORS No additional work needed for security benefits, to reduce its ability to track you: https://addons.mozilla.org/en-US/firefox/addon/privacy-oriented-origin-policy/ https://addons.mozilla.org/en-US/firefox/addon/privacy-orien... CSP, X-Frame-Options You can achieve the same effect of whitelisting 3rd parties by using an extension such as uBlock Origin or uMatrix (warning: no longer in development) in default-deny mode. HSTS https://support.mozilla.org/en-US/kb/https-only-prefs https://support.mozilla.org/en-US/kb/https-only-prefs HPKP Nobody uses this nowadays. Only semi-related, but you can turn on mandatory revocation checking (security.OCSP.require). Referrer-Policy network.http.referer.XOriginPolicy 0=always (default), 1=only if base domains match, 2=only if hosts match network.http.referer.XOriginTrimmingPolicy 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port These apply only to cross-origin requests but that's probably where you care about the referer. Note that the website's Referrer-Policy might override these, I haven't tested that.

kevin_thibedeau 5y ago

> However, I think first-party isolation causes CORS issues like when trying to pay with Paypal on another retail site. Generate URLs with a time limited token as query param. No cookies needed.

cmeacham98 5y ago

> which isolates cookies and would thus likely prevent CSRF CSRF is often done via redirecting you or submitting a form, both of which obviously completely bypass FPI and dFPI (i.e. the cookie part of Total Cookie Protection). > I'd love to see a write up how Firefox, Chrome, Brave and other browsers can be set up to prevent some of this. I only use firefox, you'll have to find information elsewhere for other browsers. CSRF, XSS, Set-Cookie Need to be fixed server-side, there is little to nothing you can do as the client. CSRF and XSS represent straight-up vulnerabilities in the website. Report to the developer and/or stop using the vulnerable website. CORS No additional work needed for security benefits, to reduce its ability to track you: https://addons.mozilla.org/en-US/firefox/addon/privacy-oriented-origin-policy/ https://addons.mozilla.org/en-US/firefox/addon/privacy-orien... CSP, X-Frame-Options You can achieve the same effect of whitelisting 3rd parties by using an extension such as uBlock Origin or uMatrix (warning: no longer in development) in default-deny mode. HSTS https://support.mozilla.org/en-US/kb/https-only-prefs https://support.mozilla.org/en-US/kb/https-only-prefs HPKP Nobody uses this nowadays. Only semi-related, but you can turn on mandatory revocation checking (security.OCSP.require). Referrer-Policy network.http.referer.XOriginPolicy 0=always (default), 1=only if base domains match, 2=only if hosts match network.http.referer.XOriginTrimmingPolicy 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port These apply only to cross-origin requests but that's probably where you care about the referer. Note that the website's Referrer-Policy might override these, I haven't tested that.