Re:Deep dive in CORS: History, how it works, and best practices
by yashap on Wednesday April 14, 2021 @01:20AM
(#26803215)
Though even still, the same-origin policy isn’t strict enough to prevent CSRF. For example, your browser will still send POSTs with Content Type application/x-www-form-urlencoded cross-origin, with cookies, even if it doesn’t let you read the response. That’s why we have to add complexity with anti-forgery tokens :/
It’ll be great when you can simply count on browsers having implemented strict SameSite cookies, because that’s such a simple, elegant solution. Anti-forgery tokens are a bit of a hack.
Re:Deep dive in CORS: History, how it works, and best practices
by danlugo92 on Wednesday April 14, 2021 @12:09PM
(#26809068)
Isn't it easy to just block all `application/x-www-form-urlencoded` requests?
Re:Deep dive in CORS: History, how it works, and best practices
by yashap on Saturday April 17, 2021 @06:27PM
(#26847991)
Most sites won’t want to do this, because HTML forms are useful! Also, that’s just one example, there are plenty of exemptions to the same origin policy: https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...
In practice, for now you either use anti-forgery tokens, you don’t put your auth tokens in cookies, or you use strict SameSite auth cookies AND block all traffic from browsers that don’t support them (mostly legacy browsers).
That is precisely why the same-origin policy sharply limits what kinds of requests evil.com is allowed to send to bank.com.