Questions tagged [same-site-cookies]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
60 views

Would “same-origin cookies” make sense?

I have read Incrementally Better Cookies, a couple of web.dev articles and tried to google for "same-origin cookies" but could not find anything so I wonder if this is being worked on. ...
0
votes
2answers
77 views

Difference between `Access-Control-Allow-Origin: *` (wildcard) and specific origins

I have a mostly public API with some parts of it "credentialed" behind cookies, similarly to e.g. how WordPress' REST API works. (In our case, it's a GraphQL API but that shouldn't matter.) ...
0
votes
1answer
66 views

Setting httponly secure cookies in microservice architecture

I have read that storing the jwt token within the httponly secure cookie is the recommended way to prevent both csrf attacks and xss attacks. When a user goes to my website they may make an api call ...
11
votes
5answers
2k views

Do I still need CSRF protection when SameSite is set to Lax?

During a security assessment I noticed that Firefox automatically set the SameSite value of a session cookie to Lax. According to the Mozilla specs, this is the case for 'modern browsers'. The ...
1
vote
1answer
540 views

What is the connection between CORS and SameSite cookie attribute?

For most of them may be its a silly question but I want it to know this in very simple language. If an application is not using CORS at all then should we put this SameSite cookie attribute? and if ...
0
votes
3answers
431 views

Cookie set from a server to a client with different domain(via XHR), but not recognized by Client domain

I have three domains but the same code base (Domain X, Domain Y, Domain Z) and Accounts website A If a user tries to sign in accounts from domain X, I wanted to SSO in the other two domains (Browser ...
0
votes
0answers
60 views

How to handle Antiforgery on Multiple ASP.Net Core APIs and Angular SPA

I am using an Angular SPA which calls multiple Asp.Net Core APIs. I need to enable Antiforgeryvalidation in all APIs and all requests should be validated. 1.) Products API hosted mydomain.com/api/...
38
votes
2answers
13k views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
0
votes
0answers
60 views

How do I assure that a site that I visit does not know I have been there before? [duplicate]

If I use the same machine (my PC) but with a different IP address and a different browser that I have never used to visit a site, will that site still be able to identify me? I don't understand the ...
-1
votes
2answers
296 views

Can a website track your browsing history on other websites?

I visited website B after visiting website A. Upon clicking the search bar on website B, a dropdown menu appeared containing the words I searched on website A. After clearing my browser history and ...
29
votes
3answers
18k views

Setting Same-Site cookie attribute to Lax

Is setting Same-Site attribute of a cookie to Lax the same as not setting it at all? If there are differences what are they?