Conventional wisdom to prevent CSRF is to use CSRF tokens, but with the new cookie attributes and prefixes, do you even need to generate/save tokens at all?

I've had the thought that if I just set a cookie with a static value, I can simply test for its existence, since SameSite ensures it won't be sent on cross-site requests, and the __Host- prefix prevents tampering via MITM and subdomain attacks.

Set-Cookie: __Host-AntiCSRF=yes; SameSite=Strict; Secure; Path=/

Would setting such a cookie fully protect me from CSRF, even if the value is static/guessable instead of a session token?



You must log in to answer this question.

Browse other questions tagged .