3 ms·
Is CSRF still a thing with SameSite cookies default Lax configuration nowadays? (ignoring when explicitly disabled)
by mhitza 5y ago
Is CSRF still a thing with SameSite cookies default Lax configuration nowadays? (ignoring when explicitly disabled)
- Techbrunch 5y agoIf you are using an up to date version of Firefox, Edge or Chrome it defaults to Lax. The exceptions are Safari, IE and Safari for IOS. I don't think this is worth a 8.1 CVSS. Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite#browser_compatibility https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...
- diroussel 5y agoThere is certainly less need for it now as browsers have many more mitigations in place than when CSRf was first introduced. But I would say yes you still need it for defence in depth. For instance in RFC6749 (OAuth 2.0) it says clients MUST implement CSRF for the redirection step.