tmatsuuのブックマーク - はてなブックマーク

CSRF is (really) dead

Scott Helme Security researcher, entrepreneur and international speaker who specialises in web techno logies. More posts by Scott Helme. A little while back I wrote a blog post about how "CSRF is dead". It focused on SameSite cookies, a powerful yet simple feature to protect your website against CSRF attacks. As powerful as it was, and as much as it will kill CSRF, you had to enable it on your site

tmatsuu 2019/09/23

ただしSafariは知らん

リンク

I'm giving up on HPKP

Scott Helme Security researcher, entrepreneur and international speaker who specialises in web techno logies. More posts by Scott Helme. HTTP Public Key Pinning is a very powerful standard that allows a host to instruct a browser to only accept certain public keys when communicating with it for a given period of time. Whilst HPKP can offer a lot of protection, it can also cause a lot of harm too. H

tmatsuu 2017/08/27

RansomPKP厳しい。HPKPなんて仕組みはない方がよかったんじゃないか。HPKPはどうも好きになれない。

リンク

Cross-Site Request Forgery is dead!

Scott Helme Security researcher, entrepreneur and international speaker who specialises in web techno logies. More posts by Scott Helme. After toiling with Cross-Site Request Forgery on the web for, well forever really, we finally have a proper solution. No technical burden on the site owner, no difficult implementation, it's trivially simple to deploy, it's Same-Site Cookies. As old as the Web its