1

For most of them may be its a silly question but I want it to know this in very simple language.

If an application is not using CORS at all then should we put this SameSite cookie attribute?

and if Application has subdomain like abc.domain.com then what is the role of Samesite attribute ?

0

If an application is not using CORS at all then should we put this SameSite cookie attribute?

In a very simple language as you requested, YES.

if Application has subdomain like abc.domain.com then what is the role of Samesite attribute ?

Irrespective of domain and subdomains CSRF attacks will be able to originate the request from the browser to do an action on behalf of the user without knowing the cookie of the user. Samesite attribute can effectively protect against CSRF attack. There are other ways to protect against CSRF too but this is one of the easiest and recommended way to do it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.