My website is using session cookies (w/ SameSite=Lax, secure, httpOnly attributes) and a CSRF Token stored in localStorage. Recently I developed a teams app, which essentially loads the website through an iframe (there is no other option then iframes). For the sessions to work, I would need to change the cookie attribute to SameSite=None. However, Google will disallow SameSite=None cookies in the future (making this not an option).

I'd like to keep session cookies w/ httpOnly attribute, because it protects against XSS session stealing (in contrast to local/sessionStorage). Is there any option keeping httpOnly session cookies while still being able to load my website via iframe (like required by teams app)?

If not, Googles Privacy initiative will reduce session security by a lot? For sure one can adhere to XSS prevention best practices, nevertheless a non negligible chance of having XSS vulnerabilities remains.

  • If you allow framing the app you should test carefully for csrf and xss attacks. The use of an httponly cookie only secures that value aginst xss... it doesn't prevent other xss attacks. Httponly cookies can sometimes generate a false sense of security. Without it you might also be safer against CSRF. (but there are other ways to automatically login user so you should consider that if you are relying on negotiate for domain users) There are reasons that anti-csrf tokens are often used along with no iframe headers/csp. Commented Apr 24 at 17:49


You must log in to answer this question.