The new 'First-Party-Only' cookie attribute:
... allows servers to assert that a cookie ought to be sent only in a "first-party" context. This assertion allows user agents to mitigate the risk of cross-site request forgery attacks, and other related paths to cross-origin information leakage.
Chrome is planning to implement the feature in chrome #50.
The spec defines First-Party
:
... as an HTTP request for a resource whose URL's origin matches the origin of the URL the user sees in the address bar.
Specifically stating:
- New windows create new first-party contexts.
- Full-page navigations create new first-party contexts. Notably, this includes both HTTP and
<meta>
-driven redirects.
<iframe>
's do not create new first-party contexts; their requests MUST be considered in the context of the origin of the URL the user actually sees in the user agent's address bar.
So the feature seems to protect against the case when CSRF is used to send a POST
request to an <iframe>
on the attacker's page. But how about the following CSRF vectors:
- The CSRF is a link or a javascript navigation to a
GET
request? The user will see a full navigation, I assume we aren't helped here. - The CSRF is a javascript submitted
POST
but the target of the form causes a full navigation to the victim's site? More likely to be dodgy as thePOST
comes from somewhere else but it's still a full navigation.
I'm excited about this new Cookie feature but to exactly what extent does it protect against CSRF attacks?