Re: First-Party-Only cookies
Mike West <[email protected]>
| Newsgroups | gmane.comp.mozilla.security |
|---|---|
| Message-ID | <CAKXHy=fAf-20peJ2n_nWF2_ztWivi=iVNZGMSZKcusFKKRXTEA@mail.gmail.com> |
On Sun, Jan 24, 2016 at 2:49 AM, Martin Thomson <[email protected]> wrote: > On Sat, Jan 23, 2016 at 1:33 AM, Mike West <[email protected]> wrote: > > Excluding GET would make that more difficult, but would certainly improve > > security. That's basically why I'm now leaning towards something like > > `SameSite=Lax`, which would allow a stepwise improvement in CSRF > protection > > over time. > > I can tolerate that. > > While the patient is on the table, why not define both labels. > SameSite=Unsafe/All perhaps? > Sure. I ran with "Strict"/"Lax" as they made the most sense to me (and because "Unsafe" in this context seems wrong: `SameSite=Unsafe` is _safer_ than not having the attribute at all). Details in the -06 draft at https://tools.ietf.org/html/draft-west-first-party-cookies-06. Feedback ever so welcome (especially feedback that went to the HTTP WG, as mnot@, et al. have noted that there's not much support for this proposal from folks other than me. :) ). -mike