Standardizing Security Semantics of Cross-Site Cookies

Hi everyone,

Dylan, Kaustubha and I have been working on a new proposal to converge
browsers on semantics for blocking cross-site cookies
in the interest of solving security challenges that arise when cross-site
cookies continue to be allowed by default in certain edge cases.

As we've outlined in the document, all browsers perform cross-site cookie
blocking a bit differently, with the main difference being that Chrome
adheres to the "site for cookies
when determining cross-site-ness for cookie blocking, whereas Firefox and
Safari compare the top-level site without considering the ancestor chain.
This particularly impacts the "ABA" case when a site A embeds another site
B, which then embeds A again.

We would like to default the web platform to the more secure behavior here,
but recognize that we have to consider viable methods for developers to opt
into the less secure alternative. One such method could be the Storage
Access API <>.

There are a lot more details in the document, and we'd appreciate your
feedback. We aim to present this topic at the 04/19 call
<> and hope to see you all there!


Received on Wednesday, 29 March 2023 14:28:45 UTC