Comment by nchmy | Hacker News Reader

Comment by nchmy | Hacker News Reader

As someone who was involved in these changes to the OWASP cheat sheet, I'm glad to see this getting implemented in the wild, as well as for the nice blog post about it all.

However, one point of clarification

> Several participants in that discussion have suggested that this method should be upgraded to a complete alternative to the standard token-based approaches. The OWASP maintainer was initially skeptical, but towards the end of the thread they appear to be warming up to the idea and in search of opinions from other leading security experts. So it is quite possible that this method will become mainstream in the near future.

The maintainer didn't just warm up to the idea - they came to accept it, otherwise the changes wouldn't have ever landed. So, the quoted section is somewhat unintentionally calling the maintainer's integrity into question.

Though, I just noticed that the cheatsheet text has changed significantly from what we settled upon. Fetch Metadata has been relegated again to defense in depth status. Hopefully there was just some mistake.

When I said "the maintainer is warming up to the idea" I meant to the idea of upgrading Fetch Metadata from the current status of defense-in-depth to a full solution that can replace the token-based approaches.

It is pretty clear to me that the maintainer is cautious and is seeking other expert opinions before accepting the proposed upgrade to full solution. This, to me, shows integrity and not the lack of it. I apologize if my choice of words somehow can be interpreted in any other way!

Again, the maintainer eventually came around.

Our confusion might be due to the fact that an erroneous PR (by seemingly an AI-wielding student...) was somehow recently accepted that completely reverted the changes we collectively worked on, which effectively made Fetch Metadata a full solution. So, it is back to showing as defense in depth. I've raised an issue about it, which wouldn't have happened if I didn't see your article!

Here's the previous language:

> If your software targets only modern browsers, you may rely on [Fetch Metadata headers](#fetch-metadata-headers) together with the fallback options described below to block cross-site state-changing requests

We then detailed some fallbacks (eg Origin header). Full text can be viewed in the original PR

https://github.com/OWASP/CheatSheetSeries/pull/1875

or

https://github.com/OWASP/CheatSheetSeries/blob/7fc3e6b8fde65...

If after reading that you still think that Fetch Metadata is not a viable full solution, I'd be curious to know why - the goal of that PR (and the preceding discussion that I instigated) was to upgrade it from Defense in Depth to Full (even if slightly less full than tokens, due to the possible need for some fallbacks).

Okay, now I understand where you are coming from.

Confession, I did not read the PR. I assumed that what is currently published in the cheatsheet is the same as the PR. This is what guided my analysis.

I will update my article to be in agreement with reality, now that I understand it. Thanks!

that should have been a fair assumption! I hope we can get this sorted out soon

It should be fixed now.

Reply on news.ycombinator.com