Re: First-Party-Only cookies

On Wed, Jan 20, 2016 at 1:53 AM, Tanvi Vyas <[email protected]> wrote:

> I believe the intention here is to prevent sites that use safe methods for
> state changing actions from depending on the First-Party-Only flag for CSRF
> protection.  In that case, the attacker could still attack the victim by
> doing a top level load of the state changing GET in a background tab.  This
> will send the First-Party-Only cookie along with the request.
>

Actually, no. I agree the spec isn't explicit enough in this (we should
make it clearer). The opened document will be a new first-party context -
but the request to fetch that document wouldn't itself have the cookie. So
for this to be an issue we'd need an XSS to forge the request - in which
case it's game over anyway