Pardon me if I am wrong, however, I am looking for an answer for my understanding that isn't the concerns regarding CSRF solved by both Samesite cookie and Same-Origin-Policy effectively? Then why is the need for 2 different things?

The basic difference which I can recollect:

Same-Origin-Policy (SOP): Is a policy set by the browser to protect a user from not letting it read the contents of another site unless the origin is same or CORS is implemented effectively

Samesite Cookie: On the other hand a job done by a server to mark a cookie to be strict or laxed as per their requirement

Is it just this? is there really a good reason behind having two different ways to prevent CSRF attacks?


The Same-Origin-Policy does not prevent CSRF attacks. It does not prevent the request from being send and it does not prevent site specific credentials (i.e. session cookie) to be attached to the request. It only prevents cross-site reading, not cross-site writing. Thus it is possible to send a fully authenticated request (i.e. with session cookie implicitly attached) cross-site which allows an attacker to do an authorized action on the server side even though the attacker cannot directly get the result of the action (i.e. read the response).

Same-Site cookies mitigate this problem with an additional restriction when a cookie will be implicitly attached to a request. Without same-site property it will be attached to all requests which includes cross-site requests. With same-site property it will no longer be attached to cross-site requests. Thus it is still possible to write cross-site, but not with cookie based authentication information implicitly attached.

| improve this answer | |
  • Great, that helps me to clear my thought process. So effectively it is the read action which is blocked by SOP, not the POST or write actions wherein if an attacker gets a hold of a cookie assuming by XXS then they could make a POST request from cross site. Is my understanding correct ? (Thus same site cookie helps) – Jiger Jain Feb 18 at 2:22
  • 1
    @JigerJain: yes, SOP just prevents the read and same-site cookie prevents attaching the cookie to the write. – Steffen Ullrich Feb 18 at 5:40
  • @JigerJain "wherein if an attacker gets a hold of a cookie assuming by XXS" The attacker doesn't necessarily need to get hold of a cookie in order to send a POST request containing that cookie. The browser attaches cookies to requests automatically, so the attacker can just send a POST request to the target site and the browser will attach the cookie to that request automatically unless the cookie is marked as SameSite. This is known as a Cross-Site Request Forgery attack, if you want to look up more information on that. – Ajedi32 Oct 21 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.