Comparison
Cross-site request forgeryvsSameSite cookie
Cross-site request forgery
another site makes the user's browser send an authenticated request to yours, and the cookie goes along automatically.
An attack exploiting the browser's habit of attaching cookies to cross-origin requests, so a third-party page can act as a logged-in user. Defences are `SameSite` cookies, a synchroniser token, and not accepting state-changing GETs. It does not apply to APIs authenticated by an `Authorization` header, because nothing attaches those automatically.
Full entry →SameSite cookie
the cookie stopped being sent when the request came from another site, and an embedded widget broke.
A cookie attribute controlling whether the cookie is attached to requests originating from other sites: `Strict` never, `Lax` only on top-level navigations, `None` always but only over HTTPS. `Lax` is now the default, which removed most cross-site request forgery by default and broke a generation of embedded widgets and payment redirects at the same time. It is a defence in depth, not a replacement for a CSRF token on state-changing requests.
Full entry →