SameSite - Revision history

Dirk Wetter: Add Safari, remark for IE11/Windows 7. Remove PHP section, see discussion.

2018-12-17T13:03:53Z

Add Safari, remark for IE11/Windows 7. Remove PHP section, see discussion.

Ayesh: Added information for PHP 7.3 new SameSite cookie support with a link to official PHP.net page and a my own article with more examples.

2018-12-14T20:46:25Z

Added information for PHP 7.3 new SameSite cookie support with a link to official PHP.net page and a my own article with more examples.

Dirk Wetter: removed site because of dangling link

2018-11-07T18:52:24Z

removed site because of dangling link

Neil Smithline: tweak grammar

2017-11-19T02:42:08Z

tweak grammar

Neil Smithline: Updated supporting browsers

2017-11-19T02:39:12Z

Updated supporting browsers

Pawel Krawczyk: add text from my article https://ipsec.pl/python/2017/understanding-http-cookie-samesite-flag-usage-scenarios.html

2017-04-21T14:44:32Z

add text from my article https://ipsec.pl/python/2017/understanding-http-cookie-samesite-flag-usage-scenarios.html

Riramar at 12:43, 21 June 2016

2016-06-21T12:43:28Z

Riramar at 01:11, 21 June 2016

2016-06-21T01:11:10Z

Riramar at 01:10, 21 June 2016

2016-06-21T01:10:42Z

Riramar at 01:10, 21 June 2016

2016-06-21T01:10:24Z

@@ Line 9: / Line 9: @@
 The default <code>lax</code> value provides a reasonable balance between security and usability for websites that want to maintain user's logged-in session after the user arrives from an external link. In the above GitHub scenario, the session cookie would be allowed when following a regular link from an external website while blocking it in CSRF-prone request methods (e.g. <code>POST</code>).
-As of November 2017 the SameSite attribute is implemented in Chrome, Firefox, and Opera.
+As of November 2017 the SameSite attribute is implemented in Chrome, Firefox, and Opera. Since version 12.1 Safari also supports this. Windows 7 with IE 11 lacks support as of December 2018, see caniuse.com below.
 == References ==

← Older revision		Revision as of 20:46, 14 December 2018
Line 10:		Line 10:

	As of November 2017 the SameSite attribute is implemented in Chrome, Firefox, and Opera.		As of November 2017 the SameSite attribute is implemented in Chrome, Firefox, and Opera.
		+
		+	[http://php.net/manual/en/function.setcookie.php PHP 7.3] has support for SameSite cookies for [https://ayesh.me/PHP-Samesite-cookies custom cookies and session cookies].

	== References ==		== References ==

← Older revision		Revision as of 18:52, 7 November 2018
Line 16:		Line 16:
	* https://caniuse.com/#search=samesite		* https://caniuse.com/#search=samesite
	* http://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/		* http://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/
−	* https://chloe.re/2016/04/13/goodbye-csrf-samesite-to-the-rescue/

@@ Line 1: / Line 1: @@
 == Overview ==
-SameSite prevents the browser from sending this cookie along with cross-site requests. The main goal is mitigate the risk of cross-origin information leakage, and provides some protection against cross-site request forgery attacks. Possible values for the flag are <code>lax</code> or <code>strict</code>.
+SameSite prevents the browser from sending this cookie along with cross-site requests. The main goal is mitigate the risk of cross-origin information leakage. It also provides some protection against cross-site request forgery attacks. Possible values for the flag are <code>lax</code> or <code>strict</code>.
 The <code>strict</code> value will prevent the cookie from being sent by the browser to the target site in all cross-site browsing context, even when following a regular link. For example, for a GitHub-like website this would mean that if a logged-in user follows a link to a private GitHub project posted on a corporate discussion forum or email, GitHub will '''not''' receive the session cookie and the user will not be able to access the project.

@@ Line 9: / Line 9: @@
 The default <code>lax</code> value provides a reasonable balance between security and usability for websites that want to maintain user's logged-in session after the user arrives from an external link. In the above GitHub scenario, the session cookie would be allowed when following a regular link from an external website while blocking it in CSRF-prone request methods (e.g. <code>POST</code>).
-As of April 2017 the SameSite attribute is implemented in Chrome and Opera.
+As of November 2017 the SameSite attribute is implemented in Chrome, Firefox, and Opera.
 == References ==

@@ Line 1: / Line 1: @@
-{{Stub}}== Overview ==
+== Overview ==
-SameSite allows a server define a cookie attribute making it impossible to the browser send this cookie along with cross-site requests. The main goal is mitigate the risk of cross-origin information leakage, and provides some protection against cross-site request forgery attacks.
+SameSite prevents the browser from sending this cookie along with cross-site requests. The main goal is mitigate the risk of cross-origin information leakage, and provides some protection against cross-site request forgery attacks. Possible values for the flag are <code>lax</code> or <code>strict</code>.
-The SameSite attribute is not fully implemented yet. At the time of this article the attribute was defined in a RFC draft available here https://tools.ietf.org/html/draft-west-first-party-cookies-07.
+The <code>strict</code> value will prevent the cookie from being sent by the browser to the target site in all cross-site browsing context, even when following a regular link. For example, for a GitHub-like website this would mean that if a logged-in user follows a link to a private GitHub project posted on a corporate discussion forum or email, GitHub will '''not''' receive the session cookie and the user will not be able to access the project.
 == References ==
 * https://tools.ietf.org/html/draft-west-first-party-cookies-07
 * http://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/
 * https://chloe.re/2016/04/13/goodbye-csrf-samesite-to-the-rescue/

← Older revision		Revision as of 01:10, 21 June 2016
Line 6:		Line 6:

	The "SameSite" attribute is not fully implemented yet. At the time of this article the attribute was defined in a RFC draft available here https://tools.ietf.org/html/draft-west-first-party-cookies-07.		The "SameSite" attribute is not fully implemented yet. At the time of this article the attribute was defined in a RFC draft available here https://tools.ietf.org/html/draft-west-first-party-cookies-07.
		+
		+	== References ==
		+
		+	* https://tools.ietf.org/html/draft-west-first-party-cookies-07
		+	* http://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/
		+	* https://chloe.re/2016/04/13/goodbye-csrf-samesite-to-the-rescue/