News for hackers. Stuff that matters.

A comment on CSRF is really dead. Parent comment

Re:CSRF is really dead by hirsin on Sunday September 08, 2019 @01:31AM (#20908780)
OK, fine - this will cost just my developer community alone 10-50 million dollars in rework. Maybe that's acceptable to the Chrome team, but I'm the one sending that mail to a hundred thousand developers, not them. So I weigh it differently.
[ Parent | on HN ]
Re:CSRF is really dead by tptacek on Sunday September 08, 2019 @09:59AM (#20910587)
What's your community and how is default SameSite=lax costing it so much?
[ Parent | on HN ]
Re:CSRF is really dead by hirsin on Sunday September 08, 2019 @12:43PM (#20911600)
Give or take 2 of the 5 largest OIDC providers. This change broke form_post in OIDC, so every app using it (low 5 digit count) needs to update and redeploy.
[ Parent | on HN ]