steffenweber
Joined 11 years ago
Karma
137
Submissions
7
Member since
Sep 1
Recent submissions
Comment · 9 years ago
Comment · 9 years ago
The conclusion of this discussion seems to be that "SameSite" cookies should be used to help preventing CSRF.
https://www.igvita.com/2016/08/26/stop-cross-site-timing-att...
Comment · 9 years ago
CSRF protection is not about attacks from evil clients (you can easily spoof any header with the HTTP client library of your choice, of course). CSRF protection is about preventing innocent / well-behaving clients from being tricked into POSTing some data on behalf of their (logged-in) user.
Comment · 9 years ago
If all browsers sent the "Origin" HTTP header [1] with POST requests (such that web applications could rely on it) then CSRF [2] tokens mentioned in the article would become obsolete. You'd just have to check whether the "Origin" header sent by the browser is identical to your scheme + domain name (e.g. "https://www.example.com") and be done. Chrome and Safari have implemented the "Origin" header long ago but unfortunately Firefox [3] and Edge [4] have not yet done so.
The "Origin" header is similar to the "Referer" header but never contains the path or query. Furthermore, CSRF protection requires it only for "POST" requests (i.e. "GET" requests are unaffected). So there is little incentive for an option disable it for privacy concerns.
[1] https://tools.ietf.org/html/rfc6454
[2] https://en.wikipedia.org/wiki/Cross-site_request_forgery
[3] https://bugzilla.mozilla.org/show_bug.cgi?id=446344
[4] https://developer.microsoft.com/en-us/microsoft-edge/platfor... (filed by me)
On SERPs, both the "flash" icon and the AMP carousel are AMP-exclusive which suggests that Google is abusing its market power.