3 ms·
Because of clientside Javascript CSRF, which is not a common condition.
by tptacek 11mo ago
Because of clientside Javascript CSRF, which is not a common condition.
- nchmy 11mo agoClient side js is not particularly relevant to csrf.
- tptacek 11mo agoI mostly agree, but that's the logic OWASP uses to argue you should still be doing explicit tokens even if you're using SameSite and Sec-Fetch.
- nchmy 11mo agoBut that's not what owasp argues. Fetch Metadata is recommended as a primary, standalone defense against CSRF (you can be forgiven for not knowing this - I worked on getting the doc updated and it landed a couple weeks ago, then was reverted erroneously, and fixed yesterday)
- tmsbrg 11mo agoWhat do you mean with clientside Javascript CSRF?