News for hackers. Stuff that matters.

A comment on A modern approach to preventing CSRF in Go. Parent comment

Re:A modern approach to preventing CSRF in Go by hmry on Wednesday October 15, 2025 @06:24AM (#45590336)
This page has some more information about the drawbacks/weaknesses of SameSite, worth a read: https://developer.mozilla.org/en-US/docs/Web/Security/Attack...

You usually need another method as well

[ Parent | on HN ]
Re:A modern approach to preventing CSRF in Go by RagingCactus on Wednesday October 15, 2025 @06:33AM (#45590389)
Yes, you're definitely right that there are edge cases and I was simplifying a bit. Notably, it's called SameSite, NOT SameOrigin. Depending on your application that might matter a lot.

In practice, SameSite=Lax is already very effective in preventing _most_ CSRF attacks. However, I 100% agree with you that adding a second defense mechanism (such as the Sec header, a custom "Protect-Me-From-Csrf: true" header, or if you have a really sensitive use case, cryptographically secure CSRF tokens) is a very good idea.

[ Parent | on HN ]