Re: [whatwg/fetch] SameSite cookies aren't sent on credentialed CORS requests (#769)

Yes, the part of your site which expects to respond to CORS requests could still be vulnerable to CSRF. But requests to this part of your site will be made in `cors` mode so you can check the `Origin` header and make sure that the request is sent same-site, getting protection equivalent (or very close) to what `SameSite` cookies offer.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/769#issuecomment-459389463