I would like to know if the Basic Authentication header for site A can be sent from site B when trying to access site A for non-GET requests (which would make the site vulnerable to CSRF attacks).
I tried to call a site on localhost
from a HTML file (at file://
), and from what I see the Authorization
header is sent. Is there a way to make the basic auth header only be sent if it's the same site, or when accessing directly from the browser address bar, like when clicking in a link? I would like to make it work just like the cookie SameSite attribute with the value Lax
:
Cookies are allowed to be sent with top-level navigations and will be sent along with GET request initiated by third party website.
This effectively stops CSRF attacks (not originated from XSS, of course) as long as GET requests ar safe (don't change state) and the browser supports it (most browsers support it already).
I would like to know if there is something similar that I can do for Basic Auth. If it helps, I'm handling the basic auth in nginx.