3 ms·
Client side js is not particularly relevant to csrf.
by nchmy 10mo ago
Client side js is not particularly relevant to csrf.
- tptacek 10mo agoI mostly agree, but that's the logic OWASP uses to argue you should still be doing explicit tokens even if you're using SameSite and Sec-Fetch.
- nchmy 10mo agoBut that's not what owasp argues. Fetch Metadata is recommended as a primary, standalone defense against CSRF (you can be forgiven for not knowing this - I worked on getting the doc updated and it landed a couple weeks ago, then was reverted erroneously, and fixed yesterday)