2 ms·
The entire web security model assumes we can trust browsers to implement web security policies!
by tptacek 11mo ago
The entire web security model assumes we can trust browsers to implement web security policies!
- louiskottmann 11mo agoI appreciate that, but in the case of TLS or CSRF tokens the server is not blindly trusting the browser in the way Sec-Fetch-Site makes it.
- tptacek 11mo agoSure it is. The same-origin rule that holds the whole web security model together is entirely a property of browser behavior.
- louiskottmann 11mo agoThat's indeed a good example of prior full trusting of the browser by the server.