5 ms·

Please point them out here.

• simonw 2y ago
  The description of SameSite isn't correct. I have some notes on that here: https://simonwillison.net/2021/Aug/3/samesite/#samesite-cookie-attribute https://simonwillison.net/2021/Aug/3/samesite/#samesite-cook...
  • zoidb 2y ago
    > As an application developer, you should set all cookies with SameSite=Lax This is really good advice and has bitten me in the past, I think as someone who is new to this it is tempting to avoid the term "Lax" but you might end up with some surprising behavior if you go with "Strict" as your default. I also attempted to make sense of it all and created https://samesite.diduthink.com https://samesite.diduthink.com
• thatha7777 2y ago
  * "Session ID" is not a cookie attribute akin to path or expires. * There's no "Session" attribute -- (when no expires is set, it's a session cookie) * session cookies deletion is misstated * JWTs are just a possible format for OAuth, not a requirement * incorrectly states that jwts are signed but not encrypted