steffenweber

Google should reward fast / jank-free websites instead of rewarding websites that use one particular technology (AMP).

On SERPs, both the "flash" icon and the AMP carousel are AMP-exclusive which suggests that Google is abusing its market power.

The conclusion of this discussion seems to be that "SameSite" cookies should be used to help preventing CSRF.

https://www.igvita.com/2016/08/26/stop-cross-site-timing-att...

CSRF protection is not about attacks from evil clients (you can easily spoof any header with the HTTP client library of your choice, of course). CSRF protection is about preventing innocent / well-behaving clients from being tricked into POSTing some data on behalf of their (logged-in) user.

If all browsers sent the "Origin" HTTP header [1] with POST requests (such that web applications could rely on it) then CSRF [2] tokens mentioned in the article would become obsolete. You'd just have to check whether the "Origin" header sent by the browser is identical to your scheme + domain name (e.g. "https://www.example.com") and be done. Chrome and Safari have implemented the "Origin" header long ago but unfortunately Firefox [3] and Edge [4] have not yet done so.

The "Origin" header is similar to the "Referer" header but never contains the path or query. Furthermore, CSRF protection requires it only for "POST" requests (i.e. "GET" requests are unaffected). So there is little incentive for an option disable it for privacy concerns.

[1] https://tools.ietf.org/html/rfc6454

[2] https://en.wikipedia.org/wiki/Cross-site_request_forgery

[3] https://bugzilla.mozilla.org/show_bug.cgi?id=446344

[4] https://developer.microsoft.com/en-us/microsoft-edge/platfor... (filed by me)