3 ms·
SameSite=Strict only prevents CSRF. Secure only means it goes over TLS/SSL only. If the site has XSS, an attacker can still perform operations on behalf of th
by Sohcahtoa82 3y ago
SameSite=Strict only prevents CSRF. Secure only means it goes over TLS/SSL only.
If the site has XSS, an attacker can still perform operations on behalf of the user even with SameSite and Secure.
- ttfkam 3y agoYou are correct. I was thinking CSRF. XSS is why Content Security Policy exists. script-src 'self' There are no silver bullets, but together, they are greater than the sum of their parts.
- Sohcahtoa82 3y agoIndeed. Defense In Depth is the name of the game.