The new 'First-Party-Only' cookie attribute:
... allows servers to assert that a cookie ought to be sent only in a "first-party" context. This assertion allows user agents to mitigate the risk of cross-site request forgery attacks, and other related paths to cross-origin information leakage.
Chrome is planning to implement the feature in chrome #50.
The spec defines
... as an HTTP request for a resource whose URL's origin matches the origin of the URL the user sees in the address bar.
- New windows create new first-party contexts.
- Full-page navigations create new first-party contexts. Notably, this includes both HTTP and
<iframe>'s do not create new first-party contexts; their requests MUST be considered in the context of the origin of the URL the user actually sees in the user agent's address bar.
So the feature seems to protect against the case when CSRF is used to send a
POST request to an
<iframe> on the attacker's page. But how about the following CSRF vectors:
GETrequest? The user will see a full navigation, I assume we aren't helped here.
POSTbut the target of the form causes a full navigation to the victim's site? More likely to be dodgy as the
POSTcomes from somewhere else but it's still a full navigation.
I'm excited about this new Cookie feature but to exactly what extent does it protect against CSRF attacks?