Re:CSRF is really dead
by tptacek on Saturday September 07, 2019 @01:56PM
(#20905401)
The point of the SameSight=Lax default is that it doesn't require any application developer intervention, and it doesn't impact 99.9% of cookie uses. It's what the default behavior should have been decades ago.
You will still need explicit CSRF defenses for the next several years. But sites that employ CSRF defenses today still have CSRF vulnerabilities, just like how they still have XSS vulnerabilities despite vdom frameworks and default output filtering. It's better to have a failure mode where modern browsers are effectively immune to the attack than one in which everyone is vulnerable.
You will still need explicit CSRF defenses for the next several years. But sites that employ CSRF defenses today still have CSRF vulnerabilities, just like how they still have XSS vulnerabilities despite vdom frameworks and default output filtering. It's better to have a failure mode where modern browsers are effectively immune to the attack than one in which everyone is vulnerable.