new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

csrf/samesite

4 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

SameSite cookie attribute values for CSRF protection

SameSite is a cookie attribute (similar to HTTPOnly, Secure) that helps mitigate CSRF attacks by controlling whether cookies are sent on cross-site requests. Possible values: Strict (prevents cookie from being sent in all cross-site browsing contexts, even following regular links), Lax (default in modern browsers - allows cookie on top-level navigations with safe methods but blocks POST/PUT/PATCH/DELETE), None (allows cookie on cross-site requests - requires Secure flag). Example: Set-Cookie: JSESSIONID=xxxxx; SameSite=Strict or Set-Cookie: JSESSIONID=xxxxx; SameSite=Lax

SameSite Lax limitation - state-changing GET requests

SameSite=Lax only blocks unsafe HTTP methods (POST, PUT, PATCH, DELETE) on cross-site requests. If any state-changing operation in the application is reachable via GET request, SameSite=Lax will not stop CSRF attacks. This is the single most common way SameSite-based defenses fail in practice. Review every GET endpoint and ensure none perform server-side state mutations.

SameSite scope limitation to registrable domain

SameSite cookie attribute is scoped to the registrable domain, not the origin. A cookie set on app.example.com with any SameSite value is still considered 'same-site' when the request originates from anything.example.com. If application shares a registrable domain with content not fully controlled (multi-tenant SaaS on shared parent domain, subdomain-hosted user content, legacy subdomains, acquired products, third-party services on subdomains), a vulnerability or malicious actor on any sibling host can issue requests that SameSite-protected cookies will accompany.

SameSite browser support and coverage

SameSite attribute is supported in all major desktop and mobile browsers. Main exceptions: Opera Mini (all versions), UC Browser for Android, older mobile browsers (iOS Safari < 13.2, Android Browser < 97). Chrome implemented SameSite=Lax as default in 2020; Firefox and Edge have followed. Coverage exceeds 98% globally. However, do not assume all traffic receives protection - users on older browsers, embedded browsers, or non-mainstream clients may not benefit from SameSite enforcement.

Give your agent this brain