top | item 46384319

(no title)

tmsbrg | 2 months ago

What do you mean with same-site cross-origin requests?

discuss

order

FiloSottile|2 months ago

See the same-site section of https://words.filippo.io/csrf/

tmsbrg|2 months ago

Oh, thanks. I learned something new. Never knew that different subdomains are considered the same "site", but MDN confirms this[0]. This shows just how complex these matters are imo, it's not surprising people make mistakes in configuring CSRF protection.

It's a pretty cool attack chain, if there's an XSS on marketing.example.com it can be used to execute a CSRF on app.example.com! It could also be used with dangling subdomain takeover or if there's open subdomain registration.

[0] https://developer.mozilla.org/en-US/docs/Glossary/Site