Re:CSRF, CORS, and HTTP Security Headers Demystified
by tehbeard on Friday April 30, 2021 @06:52AM
(#26991853)
> but it got watered down which was a real shame. I'm not sure why.
I think (and this might just be an old wive's tale) it was related to the browser connection limits being per domain, and so subdomains + looser cookie origins was a band aid for it.
Re:CSRF, CORS, and HTTP Security Headers Demystified
by hsbauauvhabzb on Friday April 30, 2021 @02:46AM
(#26990491)
Any good references on the definition? I’ve always found it awkward.
Re:CSRF, CORS, and HTTP Security Headers Demystified
by bugmen0t on Friday April 30, 2021 @03:46AM
(#26990791)
The concept of a Site is defined here https://html.spec.whatwg.org/multipage/origin.html#sites
It's basically an origin, but disregarding subdomains.
c.f. https://tools.ietf.org/html/draft-west-first-party-cookies-0... and https://tools.ietf.org/html/draft-west-first-party-cookies-0...
Excerpts (draft 2):
> If "document" is a first-party context, and "request"'s URI's origin is the same as the origin of the URI of the active document in the top-level browsing context of "document", then return "First-Party".
vs. (draft 3)
> A document is considered a "first-party context" if and only if the registerable domain of the origin of its URI is the same as the registerable domain of the first-party origin, and if each of the active documents in its ancestors' browsing contexts' is a first-party context.