I was wondering if the SameSite flag on the session cookie was enough of a protection against CSRF attacks.
I see CSRF token solution everywhere, but I am not sure about the need to use a CSRF token if the cookie used for authentication is already protected by the SameSite flag (in Strict mode).
On top of that, if I understood it well, tho cookie would still be sent along with subdomain URLs like api.myapp.com
which would be perfect for my needs.
lundi 25 janvier 2021
SameSite Flag against CSRF
Inscription à :
Publier les commentaires (Atom)
Aucun commentaire:
Enregistrer un commentaire