Comment

Comment by al2o3cr

    Website operators will need to do nothing to have the powerful
    protection of SameSite by default
Alternative phrasing:

    Website operators who depend on the existing behavior will have to
    make changes to have their sites work in Chrome at all
IMO this is a useless default - sites will still need existing CSRF protection techniques since not everyone runs Chrome - that will marginally increase security on small fraction of sites (that DGAF about CSRF) and break a small fraction of sites.
parent al2o3cr 7 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton