Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [same-site-cookies]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
41 views

CSRF using Client Side redirect

I have seen in an article regarding CSRF bypass when cookie set with Samesite: Strict. Normally if a cookie is set with Samesite: Strict then it will not be send in a cross origin request. But if the ...
Allen Johnson's user avatar
0 votes
1 answer
172 views

Is using two cookies one Lax and one Strict a way to improve usability without compromising security?

My understanding is that Strict is the best as, admitting you have a recent browser, it completely replaces the need for CSRF Token. Strict is however a big hit on usability as things like SSO or ...
allan.simon's user avatar
4 votes
1 answer
1k views

Why is the browser not sending cookies with cross-domain WebSocket handshake request?

If I have understood Cross-Site WebSocket Hijacking (CSWSH) attack correctly [1][2][3][4], the attack relies on two things (examples are from the first reference): the browser sending the cookies set ...
sherlock's user avatar
  • 569
2 votes
1 answer
390 views

Is it dangerous to expose a front-channel logout endpoint that does not require authentication?

I have several apps connected to a single Identity Provider, which allows a Single SignOn experience for our users, and requires also a Single LogOut one. For the logout, any app will start the logout ...
Tao Gómez Gil's user avatar
0 votes
1 answer
1k views

How to display first party website to third party website | inside the Iframe

I have www.example.com a WordPress website and www.official.com this third-party website, I want to invoke <iframe src="www.example.com"></iframe> in www.official.com Here my ...
Fasal Basha's user avatar
2 votes
0 answers
97 views

Auth Token not included in CORS exploit [closed]

I have found a CORS on a website but when I am trying to exploit it for a POC it is fetching all the cookies except auth cookies and due to that I am getting an error message to "User not logged ...
Abhinav Kumar's user avatar
0 votes
0 answers
84 views

Security of the not transmitted cookie

If I have session cookie or just cookie which is Secure, HttpOnly with SameSite=Strict and is never transmitted even in requests within the same domain and the page uses TLS. Is there any attack that ...
Szyszka947's user avatar
0 votes
1 answer
77 views

Do I need to set up super global SESSION for a web form?

I am building a web form in PHP, is just for the user to request information about my services or send comments, so I don‘t need the user to be logged with a username and a password, no databse. I ...
limakid's user avatar
3 votes
1 answer
2k views

Browser sends cookie with "SameSite=Strict" attribute on another domain

I am solving PortSwigger's lab: "CSRF where token is tied to non-session cookie". For testing SameSite attribute I created a cookie in my browser with SameSite=Strict for domain https://<...
ZOOM SMASH's user avatar
1 vote
1 answer
1k views

Security risks to returning JWT token in the response body to a GET request?

Are there any security risks to returning a user's JWT in the response body to a GET request? The JWT is only returned for authenticated users. Authentication is managed via a JWT stored as a HttpOnly,...
Stud Sterkel's user avatar
1 vote
0 answers
345 views

I have CSRF protection implemented server side, can I safely use `SameSite=None; Secure; HttpOnly`?

We have a web service where GET is always safe and all unsafe POST requests use single-use CSRF tokens. We have some cases where cross-origin domain would need to pass us POST request with data that ...
Mikko Rantalainen's user avatar
1 vote
0 answers
845 views

Is a static SameSite cookie enough to protect against CSRF?

Conventional wisdom to prevent CSRF is to use CSRF tokens, but with the new cookie attributes and prefixes, do you even need to generate/save tokens at all? I've had the thought that if I just set a ...
a cat's user avatar
  • 113
2 votes
1 answer
1k views

Why does Chrome require Secure for SameSite=None cookies?

As I understand it, the SameSite attribute for cookies helps me advise standard browsers what they can do with them. So if I'm a server running on http://acme.com/my-app and I've set a cookie like: ...
Druckles's user avatar
  • 153
2 votes
1 answer
294 views

Would "same-origin cookies" make sense?

I have read Incrementally Better Cookies, a couple of web.dev articles and tried to google for "same-origin cookies" but could not find anything so I wonder if this is being worked on. ...
Borek Bernard's user avatar
2 votes
2 answers
5k views

Difference between `Access-Control-Allow-Origin: *` (wildcard) and specific origins

I have a mostly public API with some parts of it "credentialed" behind cookies, similarly to e.g. how WordPress' REST API works. (In our case, it's a GraphQL API but that shouldn't matter.) ...
Borek Bernard's user avatar
1 vote
1 answer
2k views

Setting httponly secure cookies in microservice architecture

I have read that storing the jwt token within the httponly secure cookie is the recommended way to prevent both csrf attacks and xss attacks. When a user goes to my website they may make an api call ...
Dan's user avatar
  • 13
0 votes
0 answers
62 views

How do I assure that a site that I visit does not know I have been there before? [duplicate]

If I use the same machine (my PC) but with a different IP address and a different browser that I have never used to visit a site, will that site still be able to identify me? I don't understand the ...
Sam Branner's user avatar
2 votes
3 answers
12k views

Cookie set from a server to a client with different domain(via XHR), but not recognized by Client domain

I have three domains but the same code base (Domain X, Domain Y, Domain Z) and Accounts website A If a user tries to sign in accounts from domain X, I wanted to SSO in the other two domains (Browser ...
Kannan M's user avatar
  • 121
-1 votes
2 answers
2k views

Can a website track your browsing history on other websites?

I visited website B after visiting website A. Upon clicking the search bar on website B, a dropdown menu appeared containing the words I searched on website A. After clearing my browser history and ...
Ray's user avatar
  • 1
31 votes
5 answers
15k views

Do I still need CSRF protection when SameSite is set to Lax?

During a security assessment I noticed that Firefox automatically set the SameSite value of a session cookie to Lax. According to the Mozilla specs, this is the case for 'modern browsers'. The ...
Beurtschipper's user avatar
6 votes
2 answers
6k views

What is the connection between CORS and SameSite cookie attribute?

For most of them may be its a silly question but I want it to know this in very simple language. If an application is not using CORS at all then should we put this SameSite cookie attribute? and if ...
ZeroNullByte's user avatar
29 votes
3 answers
19k views

Setting Same-Site cookie attribute to Lax

Is setting Same-Site attribute of a cookie to Lax the same as not setting it at all? If there are differences what are they?
user157829's user avatar
53 votes
2 answers
24k views

Will same-site cookies be sufficient protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
Mirsad's user avatar
  • 10.2k