Tag
csrf
- Apr 29, 2025 Cross-Site Request Forgery and the Problem of Ambient Authority Why a browser attaches cookies to requests it did not intend to make, which request shapes are reachable without a script, and how token binding restores an intent check. security
- Jun 12, 2023 CSRF Defence: Synchronizer Tokens, Fetch Metadata, and SameSite Why ambient credentials make state-changing requests forgeable, what a synchronizer token must be bound to, and how Sec-Fetch-Site lets a server reject cross-site writes without per-form state. web platform
- Jan 23, 2022 How Cookie Attributes Bound a Session Credential What the Domain, Path, Secure, HttpOnly, and SameSite attributes actually constrain, which of them are enforced by the browser versus the server, and where the scope model leaks. security