I have read Incrementally Better Cookies, a couple of web.dev articles and tried to google for "same-origin cookies" but could not find anything so I wonder if this is being worked on.
Lax are a very good protection against CSRF but hacked subdomains remain a way to attack – for example,
hacked.example.com can forge credentialed requests to
I would imagine that restricting cookies further, from same-site to same-origin, would be a logical next step. What is being worked on is schemeful same-site (distinguishing
https:// when considering what is same-site) but why not use the concept of origin?