4 ms·
Which is why you'd use HttpOnly along with the SameSite=Strict and Secure attributes. This would prevent an attacker from both sniffing and performing operatio
by ttfkam 3y ago
Which is why you'd use HttpOnly along with the SameSite=Strict and Secure attributes.
This would prevent an attacker from both sniffing and performing operations on behalf of the user via XSS.
- Sohcahtoa82 3y agoSameSite=Strict only prevents CSRF. Secure only means it goes over TLS/SSL only. If the site has XSS, an attacker can still perform operations on behalf of the user even with SameSite and Secure.
- ttfkam 3y agoYou are correct. I was thinking CSRF. XSS is why Content Security Policy exists. script-src 'self' There are no silver bullets, but together, they are greater than the sum of their parts.
- Sohcahtoa82 3y agoIndeed. Defense In Depth is the name of the game.