Hacker News Reader

What we really want is a failsafe way of setting cookies: i.e. a way of setting cookies that won't work on browsers without SameSite support. Otherwise this solution will still leave a security hole for the many users not on (the latest version of) Chrome.

Ideally we could do this by intentionally making the SameSite cookie syntax non-backwards-compatible.

View on HN

So... Break the web for anyone not on the latest version of Chrome?

No, just give devs the ability to easily catch the error & use an alternative, secure solution.

If there were an easy, alternative secure solution then developers would already be using it.

Implementing common anti-XSRF mechanisms like a session token in a form field or extra http header requires modifying every place your app communicates with the server. It’s anything but easy which is why so many apps/websites not built with XSRF in mind still have vulnerabilities.

"easily"

Reply on news.ycombinator.com