Tag
samesite
- Apr 24, 2026 Cookie Scoping, SameSite, and the Site Boundary How cookies are addressed by host and path rather than of origin, what SameSite Lax and Strict actually permit, and where domain-scoped cookies leak across unrelated applications. web platform
- Jun 12, 2023 CSRF Defence: Synchronizer Tokens, Fetch Metadata, and SameSite Why ambient credentials make state-changing requests forgeable, what a synchronizer token must be bound to, and how Sec-Fetch-Site lets a server reject cross-site writes without per-form state. web platform