SameSite property
Starting with Chrome 51, a new SameSite attribute has been added to the browser's cookies to prevent CSRF attacks and user tracking (malicious third-party acquisition of cookies), and to limit third-party cookies, thereby reducing security risks.
SameSite defined in RFC6265bis:The hyperlink login is visible.
About CSRF Attack Recap:
The SameSite property can be set to three values:Strict、Lax、None。
Strict: Strictly prohibit third parties from obtaining cookies, and do not send cookies under any circumstances when cross-site; Cookies will only be included if the URL of the current page matches the request target. This rule is too strict and can cause a very bad user experience. For example, if there is a GitHub link on the current web page, users will not have GitHub cookies when they click on the jump, and the jump has always been unlogged in.
Lax: Prevent cross-site, in most cases it is forbidden to obtain cookies, except for GET requests (links, preloads, GET forms) that navigate to the destination URL; Once Strict or Lax is set, CSRF attacks are basically eliminated. Of course, this is provided that the user browser supports the SameSite property.
SameSite attributeDefault SameSite=Lax[This operation applies to versions after Google releases Chrome 80 stable version on February 4, 2019]
None: There is no limit.
The Secure attribute must also be set (cookies can only be sent over the HTTPS protocol), otherwise it will not be valid. [This operation applies to versions after Google releases Chrome 80 stable version on February 4, 2019]
Test the SameSite property
We dynamically load a picture of site A through the F12 console at site A, the code is as follows:
We can see from the network request that when site A requests an image of the domain name of site A, it willCarry cookies(SameSite has no settings, i.e., Lax), as shown in the image below:
We randomly find a B site, and then dynamically load the picture of A site and find itNot carryingAny cookie, as shown below:
(End)
|
Posted on 2022-4-17 20:24:47
|
|
|
|
Posted on 2022-4-17 21:20:07