3 ms·
Isn't this problem also solved by disabling 3rd party cookies? This is a feature already in the browser. I've used it for months and the only thing that I've no
by jmvoodoo 15y ago
Isn't this problem also solved by disabling 3rd party cookies? This is a feature already in the browser. I've used it for months and the only thing that I've noticed not working (i.e. the only impact on me as a user) is that integrated disqus forums on some blogs don't work.
- tptacek 15y agoNo, disabling 3rd party cookies does not stop CSRF.
- jmvoodoo 15y agoCan you explain? My understanding was that cookies will not be sent in these attacks (I validated this only testing some approaches, namely doubleclick and other ad embeds). Without cookies, how would the CSRF attack access my account? Or have I missed something obvious?
- eurleif 15y agoDisabling third party cookies disables cookies in certain contexts, like when loading images and frames from another domain, but there are other ways to perform a CSRF attack. A link or form that doesn't target a frame would still work.
- jmvoodoo 15y agoGot it that makes sense. It seems like a link would be a real problem to solve and keep the web usable. The form approach seems easy enough to solve with a dialog. The others that can be solved via tighter cookie restrictions probably should be.. Too many permission dialogs and you end up annoying the user, or worse, train them to accept without reading.