Questions tagged [same-site-cookies]
The same-site-cookies tag has no usage guidance.
9
questions
0
votes
1answer
51 views
Setting httponly secure cookies in microservice architecture
I have read that storing the jwt token within the httponly secure cookie is the recommended way to prevent both csrf attacks and xss attacks.
When a user goes to my website they may make an api call ...
0
votes
0answers
49 views
How to handle Antiforgery on Multiple ASP.Net Core APIs and Angular SPA
I am using an Angular SPA which calls multiple Asp.Net Core APIs. I need to enable Antiforgeryvalidation in all APIs and all requests should be validated.
1.) Products API hosted mydomain.com/api/...
0
votes
0answers
59 views
How do I assure that a site that I visit does not know I have been there before? [duplicate]
If I use the same machine (my PC) but with a different IP address and a different browser that I have never used to visit a site, will that site still be able to identify me? I don't understand the ...
0
votes
3answers
180 views
Cookie set from a server to a client with different domain(via XHR), but not recognized by Client domain
I have three domains but the same code base (Domain X, Domain Y, Domain Z) and
Accounts website A
If a user tries to sign in accounts from domain X, I wanted to SSO in the other two domains (Browser ...
-1
votes
2answers
251 views
Can a website track your browsing history on other websites?
I visited website B after visiting website A. Upon clicking the search bar on website B, a dropdown menu appeared containing the words I searched on website A. After clearing my browser history and ...
11
votes
5answers
2k views
Do I still need CSRF protection when SameSite is set to Lax?
During a security assessment I noticed that Firefox automatically set the SameSite value of a session cookie to Lax. According to the Mozilla specs, this is the case for 'modern browsers'.
The ...
1
vote
1answer
494 views
What is the connection between CORS and SameSite cookie attribute?
For most of them may be its a silly question but I want it to know this in very simple language.
If an application is not using CORS at all then should we put this SameSite cookie attribute?
and if ...
29
votes
3answers
18k views
Setting Same-Site cookie attribute to Lax
Is setting Same-Site attribute of a cookie to Lax the same as not setting it at all? If there are differences what are they?
38
votes
2answers
13k views
Will same-site cookies be sufficent protection against CSRF and XSS?
I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks.
So, how effective will this protection be?
...
