Hacker News new | past | comments | ask | show | jobs | submit login

No-one is going to set a strict SameSite cookie, it just breaks too much, it's the same level of hubris as thinking developers are going to care about CSP. It just breaks too much shit.

So we're left with Lax SameSite cookies, which is pretty much the same as what existing web frameworks do.

The best you can say is that this is less likely to have bugs in the implementation.




I'd say surely banks will use this for their online banking systems.

Then I wonder, because of some of the delightful vulnerabilities I've heard about.

So I'll just say banks certainly should use Strict SameSite cookies, and in fact they seem designed to suit banking workloads (especially as banks don't usually offer persistent logins, because that's too dangerous).




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: