Pardon me if I am wrong, however, I am looking for an answer for my understanding that isn't the concerns regarding CSRF solved by both Samesite cookie and Same-Origin-Policy effectively? Then why is the need for 2 different things?

The basic difference which I can recollect:

Same-Origin-Policy (SOP): Is a policy set by the browser to protect a user from not letting it read the contents of another site unless the origin is same or CORS is implemented effectively

Samesite Cookie: On the other hand a job done by a server to mark a cookie to be strict or laxed as per their requirement

Is it just this? is there really a good reason behind having two different ways to prevent CSRF attacks?


The Same-Origin-Policy does not prevent CSRF attacks. It does not prevent the request from being send and it does not prevent site specific credentials (i.e. session cookie) to be attached to the request. It only prevents cross-site reading, not cross-site writing. Thus it is possible to send a fully authenticated request (i.e. with session cookie implicitly attached) cross-site which allows an attacker to do an authorized action on the server side even though the attacker cannot directly get the result of the action (i.e. read the response).

Same-Site cookies mitigate this problem with an additional restriction when a cookie will be implicitly attached to a request. Without same-site property it will be attached to all requests which includes cross-site requests. With same-site property it will no longer be attached to cross-site requests. Thus it is still possible to write cross-site, but not with cookie based authentication information implicitly attached.

| improve this answer | |
  • Great, that helps me to clear my thought process. So effectively it is the read action which is blocked by SOP, not the POST or write actions wherein if an attacker gets a hold of a cookie assuming by XXS then they could make a POST request from cross site. Is my understanding correct ? (Thus same site cookie helps) – Jiger Jain Feb 18 at 2:22
  • 1
    @JigerJain: yes, SOP just prevents the read and same-site cookie prevents attaching the cookie to the write. – Steffen Ullrich Feb 18 at 5:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.