CSRF
CSRF (cross-site request forgery) is a web security vulnerability in which an attacker induces a user to perform unintended actions on a website where the user is already authenticated. Defenses include SameSite cookies and CSRF tokens.
Timeline (last 90 days)
Complete security testing should also cover dimensions such as authentication bypass, privilege escalation, CSRF, and sensitive information leakage, requiring dedicated tools such as SAST and DAST plus manual penetration testing.
The SameSite attribute cannot defend against compromised subdomains or requests initiated by same-site XSS, and also depends on correct browser implementation, so it cannot replace the double-submit cookie or synchronizer token pattern.
The SameSite attribute is a cookie control field used by browsers to defend against CSRF, with three main values: Strict, Lax, and None.
All Facts (3)
Complete security testing should also cover dimensions such as authentication bypass, privilege escalation, CSRF, and sensitive information leakage, requiring dedicated tools such as SAST and DAST plus manual penetration testing.
50%UnverifiedThe SameSite attribute cannot defend against compromised subdomains or requests initiated by same-site XSS, and also depends on correct browser implementation, so it cannot replace the double-submit cookie or synchronizer token pattern.
50%UnverifiedThe SameSite attribute is a cookie control field used by browsers to defend against CSRF, with three main values: Strict, Lax, and None.
50%