News for hackers. Stuff that matters.

A comment on Userdir URLs like https://example.org/~username/ are dangerous. Parent comment

Re:Userdir URLs like https://example.org/~username/ are dang... by vbezhenar on Tuesday April 07, 2020 @11:22PM (#22809752)
What about setting Cookie with Path and SameSite=LAX? I would expect it to prevent sending cookies in that request, although I did not test it.
[ Parent | on HN ]
Re:Userdir URLs like https://example.org/~username/ are dang... by justinsteven on Wednesday April 08, 2020 @12:17AM (#22810020)
I tested with SameSite being Lax and Strict. Neither block the attack in Chrome. My reading of the SameSite spec indicates that it doesn't take cookie path into account.
[ Parent | on HN ]