3 ms·

I didn't get this article. This first part explains common CSRF vulnerabilities, and then even explains the SameSite attribute, but it neglected to point out th

I didn't get this article. This first part explains common CSRF vulnerabilities, and then even explains the SameSite attribute, but it neglected to point out that SameSite=Lax is now the default on browsers, and has been for some time, specifically to mitigate the problems outlined in this article and to get rid of the need for CSRF tokens.

kevincox 2y ago
> SameSite=Lax is now the default on browsers Note on all major browsers unfortunately: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#browser_compatibility https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se... A real shame, because it would be a pretty robust solution for sites that don't require any cross-origin interactions at all. That being said it is well supported if set explicitly. So if you can ensure that all cookies that your app sets have the attribute you should be good to go.