Difference between revisions of "SameSite"
From MgmtWiki
(→References) |
(→Other Materiel) |
||
| Line 14: | Line 14: | ||
===Other Materiel=== | ===Other Materiel=== | ||
* [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite SameSite cookies] from Mozilla. | * [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite SameSite cookies] from Mozilla. | ||
| + | * [https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-07 Cookies: HTTP State Management Mechanism] Google & Apple - caution this draft will likely be changed by the time you are reading this. | ||
[[Category: Authentication]] | [[Category: Authentication]] | ||
Revision as of 10:59, 8 May 2021
Full Title or Meme
SameSite is an attribute in HTTP that is applied to the Cookie header.
Context
Cross-site scripting (XSS) attacks have allows an attacker to see and reuse cookies supplied for Authentication of a user by another site.
Problems
- The use of Cookies on various devices and User Agents has be restricted in ever more severe ways. These restrictions have limited the functionality of the Authentication Cookie.
- In particular Apple introduced a restriction on SameSite cookies that caused common implementations of OAuth 2.0 and OpenID Connect to fail. Brock Allen has decoded that issue on his site[1] The basic problem with OAuth front channel Authentication is determining which site is the SameSite. So, while the authentication works, the redirect to the client code is not considered, by iOS 12, to be a same-site operation. Even in the case a refresh of the client site will work and be fully authenticated, because it is not a redirect, but a SameSite operation.
References
- ↑ Brock Allen, Same-site cookies, ASP.NET Core, and external authentication providers. (2019-01-11) https://brockallen.com/2019/01/11/same-site-cookies-asp-net-core-and-external-authentication-providers/
Other Materiel
- SameSite cookies from Mozilla.
- Cookies: HTTP State Management Mechanism Google & Apple - caution this draft will likely be changed by the time you are reading this.
