search

erlyaws / yaws

Yaws webserver
https://erlyaws.github.io
BSD 3-Clause "New" or "Revised" License
1.28k stars 267 forks source link

feature request: 'SameSite' cookie attribute #321

Closed leoliu closed 3 years ago

leoliu commented 6 years ago

Now supported by Firefox and Chrome per https://caniuse.com/#feat=same-site-cookie-attribute. But the draft spec sees no update for a long time. So maybe wait until it is part of the standard. https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00

leoliu commented 6 years ago

This feature is now in Firefox and Chrome. Looks like it is landing in Microsoft Edge browser according to https://blogs.windows.com/msedgedev/2018/05/17/samesite-cookies-microsoft-edge-internet-explorer/. It is the simplest and most effective way to mitigate CSRF attacks.