Questions tagged [same-site-cookies]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
38
votes
2answers
13k views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
11
votes
5answers
2k views

Do I still need CSRF protection when SameSite is set to Lax?

During a security assessment I noticed that Firefox automatically set the SameSite value of a session cookie to Lax. According to the Mozilla specs, this is the case for 'modern browsers'. The ...