CSRF Protection with samesite Cookie

The-OAG-Development-Project / Application-Gateway

OWASP Application Gateway is an HTTP proxy that handles Oauth2 authentication and session management

https://owasp.org/www-project-application-gateway/

Apache License 2.0

83 stars 4 forks source link

CSRF Protection with samesite Cookie #18

Closed gianlucafrei closed 3 years ago

gianlucafrei commented 3 years ago

We should implement a csrf protection mechanism with samesite strict cookies. This way Nelly could offer a csrf protection mechanism that requires no implementation in the application.

-> Create change the csrf cookie to samesite strict -> Validate if the cookie is present

See also the documentation on https://github.com/gianlucafrei/nellygateway/wiki/SecurityProfiles

gianlucafrei commented 3 years ago

Implemented with version 0.3