Skip to content

Allow settings SameSite to strict to further prevent CSRF #189

@spthiel

Description

@spthiel

Describe the idea / solution you'd like
I would like to reconfigure the SameSite policy of the cookies set by copyparty to be SameSite to prevent any possibility of a CSRF.

SameSite=Strict on cookies makes it so requests from different origins cannot use the cookies stored on the page making any CS Requests automatically result in a unauthorized response removing any eventual attack vector your CSRF Script may forgot about.
===

I intended to submit a PR for this instead but after looking around for half an hour I got no idea how your configuration object works nor how you could access it in utils#gencookie 😓

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions