My understanding is that
Strictis the best as, admitting you have a recent browser, it completely replaces the need for CSRF Token.
Strictis however a big hit on usability as things like SSO or just having a link in email to go to a logged page will load the page without the cookie.
Would it be viable approach if :
- The user start a session (logs to a website
Laxone with just "has_a_strict_cookie=true"
example.comalso set a
Strictone with your usual session id etc. in it
- The user-agent request a resource
- if the
Strictcookie is sent, we are in normal "same origin" navigation, the resource
- if only the
Laxcookie is present, it means the user has a session BUT it comes from a "cross origin" context, in which case
example.comcould redirect to
sensitiveresource, so that the
Strictcookie is then sent ?
- if neither are present it means the user has no session at all and we simple redirect to a login page
- if the
In term of security:
- only the
Strictcookie allow access to sensitive information (session id) so it's not possible to become lazy and to start to only rely on the
- The redirection on the intermediate page does not disclose more information than a redirect to a login page would have
In term of usability:
- You can have external link to sensitive resource / SSO scheme
- The only compromise is to have during a second an intermediate page
Am I missing something ? If not, why is not advertised more ? Most resources on the web as of 2023 seems to be "Either use Strict if you need absolute security and can live with its limitation or use Lax but you're not fully protected against CSRF attack on GET resource that modify state"