Questions tagged [same-site-cookies]
The same-site-cookies tag has no usage guidance.
16
questions
0
votes
1
answer
56
views
Browser sends cookie with "SameSite=Strict" attribute on another domain
I am solving PortSwigger's lab: "CSRF where token is tied to non-session cookie". For testing SameSite attribute I created a cookie in my browser with SameSite=Strict for domain https://<...
- 103
0
votes
1
answer
181
views
Security risks to returning JWT token in the response body to a GET request?
Are there any security risks to returning a user's JWT in the response body to a GET request? The JWT is only returned for authenticated users. Authentication is managed via a JWT stored as a HttpOnly,...
- 775
0
votes
0
answers
60
views
I have a non-Oauth service and am using this approach with Server initiated HttpOnly cookies with stripped JWT
My question is : Is this approach correct given I have a non-Oauth service? My goal is to use the simplest amount of security features while still being as strong as possible.
My approach is as ...
- 101
0
votes
0
answers
108
views
I have CSRF protection implemented server side, can I safely use `SameSite=None; Secure; HttpOnly`?
We have a web service where GET is always safe and all unsafe POST requests use single-use CSRF tokens. We have some cases where cross-origin domain would need to pass us POST request with data that ...
1
vote
0
answers
264
views
Is a static SameSite cookie enough to protect against CSRF?
Conventional wisdom to prevent CSRF is to use CSRF tokens, but with the new cookie attributes and prefixes, do you even need to generate/save tokens at all?
I've had the thought that if I just set a ...
- 113
2
votes
1
answer
289
views
Why does Chrome require Secure for SameSite=None cookies?
As I understand it, the SameSite attribute for cookies helps me advise standard browsers what they can do with them.
So if I'm a server running on http://acme.com/my-app and I've set a cookie like:
...
- 143
2
votes
1
answer
172
views
Would "same-origin cookies" make sense?
I have read Incrementally Better Cookies, a couple of web.dev articles and tried to google for "same-origin cookies" but could not find anything so I wonder if this is being worked on.
...
- 345
0
votes
2
answers
637
views
Difference between `Access-Control-Allow-Origin: *` (wildcard) and specific origins
I have a mostly public API with some parts of it "credentialed" behind cookies, similarly to e.g. how WordPress' REST API works. (In our case, it's a GraphQL API but that shouldn't matter.)
...
- 345
1
vote
1
answer
431
views
Setting httponly secure cookies in microservice architecture
I have read that storing the jwt token within the httponly secure cookie is the recommended way to prevent both csrf attacks and xss attacks.
When a user goes to my website they may make an api call ...
- 13
0
votes
0
answers
60
views
How do I assure that a site that I visit does not know I have been there before? [duplicate]
If I use the same machine (my PC) but with a different IP address and a different browser that I have never used to visit a site, will that site still be able to identify me? I don't understand the ...
1
vote
3
answers
3k
views
Cookie set from a server to a client with different domain(via XHR), but not recognized by Client domain
I have three domains but the same code base (Domain X, Domain Y, Domain Z) and
Accounts website A
If a user tries to sign in accounts from domain X, I wanted to SSO in the other two domains (Browser ...
- 111
-1
votes
2
answers
605
views
Can a website track your browsing history on other websites?
I visited website B after visiting website A. Upon clicking the search bar on website B, a dropdown menu appeared containing the words I searched on website A. After clearing my browser history and ...
- 1
19
votes
5
answers
5k
views
Do I still need CSRF protection when SameSite is set to Lax?
During a security assessment I noticed that Firefox automatically set the SameSite value of a session cookie to Lax. According to the Mozilla specs, this is the case for 'modern browsers'.
The ...
- 663
3
votes
2
answers
1k
views
What is the connection between CORS and SameSite cookie attribute?
For most of them may be its a silly question but I want it to know this in very simple language.
If an application is not using CORS at all then should we put this SameSite cookie attribute?
and if ...
- 69
29
votes
3
answers
18k
views
Setting Same-Site cookie attribute to Lax
Is setting Same-Site attribute of a cookie to Lax the same as not setting it at all? If there are differences what are they?
- 393
45
votes
2
answers
17k
views
Will same-site cookies be sufficient protection against CSRF and XSS?
I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks.
So, how effective will this protection be?
...
- 9,963