Web security updates #98
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
julien-piet
commented
Sep 10, 2024
julien-piet
commented
- Added phishing
- Added a discussion about cookie policies versus SOP
- Added a CSRF defense
- Fixed typos
* Added phishing * Added a discussion about cookie policies versus SOP * Added a CSRF defense * Fixed typos
|
linking for awareness - issue #19 |
davidwagner
reviewed
Sep 15, 2024
|
|
||
| ## 21.4. Defense: SameSite Cookie Attribute | ||
|
|
||
| A last way to defend against CSRF attacks is to add a flag to cookies that specifies it should be sent only when the domain of the cookie exactly matches the domain of the origin. For example, with this flag, if `evil.com` causes the browser to make a request to `bank.com`, cookies for `bank.com` will not be sent if because the origin domain (`evil.com`) and cookie domain (`bank.com`) are different. Unfortunately, this browser-side defense is not implemented on all browsers, thus is usually only used as a defense-in-depth strategy. |
There was a problem hiding this comment.
SameSite actually works with "sites" which are coarser than origins. For instance, usercontent.berkeley.edu can attack www.berkeley.edu. But maybe that's unimportant in this context.
davidwagner
approved these changes
Sep 15, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.