New answers tagged csrf
1
Let me explain the specification.
The definition of "same-site" is :
A request is "same-site" if its target's URI's origin's registered
domain is an exact match for the request's client's "site for
cookies", or if the request has no client. The request is otherwise
"cross-site".
For a given request ("request"), the following ...
1
The SameSite policy still misses the mark for trustworthy cross-domain services.
Say I am browsing a site at firstparty.com which loads a script from mytrustedpartner.com to provide valuable functionality to my site.
mytrustedpartner.com could be some sort of widget that uses cookies to store state about the user that persists while the users continues to ...
0
The target URI’s “registered domain” must be an “exact match” for the request’s “site for cookies”.
You know what a “registered domain” is: The domain name you can buy or rent, i.e. one level below the public suffix.
The “site for cookies“ is usually the “registered domain” as well – here, of the request. This is true when the document is “in a top-level ...
1
The same origin policy does not prevent all authenticated cross site interactions. Specifically, cross origin writes and embeds are generally allowed, while reads are prevented:
Cross-origin writes are typically allowed. Examples are links, redirects, and form submissions.
Cross-origin embedding is typically allowed.
Cross-origin reads are ...
3
The 'Site' in SameSite refers to a the combination of second level domain mysite.com and top level domain mysite.com.
This means that a requests from login.mysite.com to cdn.mysite.com
would be considered a same-site request.
BUT... as you might imagine it does not end there. There is the Public Suffixes List which slightly changes this validation ...
Top 50 recent answers are included
