CheatSheetSeries

Again, the maintainer eventually came around. Our confusion might be due to the fact that an erroneous PR (by seemingly an AI-wielding student...) was somehow recently accepted that completely reverted the changes we collectively worked on, which effectively made Fetch Metadata a full solution. So, it is back to showing as defense in depth. I've raised an issue about it, which wouldn't have happened if I didn't see your article! Here's the previous language: > If your software targets only modern browsers, you may rely on [Fetch Metadata headers](#fetch-metadata-headers) together with the fallback options described below to block cross-site state-changing requests We then detailed some fallbacks (eg Origin header). Full text can be viewed in the original PR https://github.com/OWASP/CheatSheetSeries/pull/1875 or https://github.com/OWASP/Ch

Once again, you have no idea what you're talking about. Moreover, you lack critical thinking skills - the Sec-Fetch-Site section in that doc is senseless and will now be modified to say that Sec-Fetch-Site is sufficient on its own. https://github.com/OWASP/CheatSheetSeries/issues/1803

You might want to develop some critical thinking skills. The doc is wrong, and will soon be updated to say that Sec-Fetch-Site is sufficient on its own. https://github.com/OWASP/CheatSheetSeries/issues/1803

The doc is wrong and will be updated soon to say that Sec-Fetch-Site is sufficient on its own. https://github.com/OWASP/CheatSheetSeries/issues/1803

False. OWASP will now be modifying it's doc on the topic to say that Sec-Fetch-Site is sufficient on its own, rather than defense in depth. You really have no idea what you're talking about. https://github.com/OWASP/CheatSheetSeries/issues/1803

Fixed: https://github.com/OWASP/CheatSheetSeries/issues/1089#issuec...

They didn’t reintroduce the error; it was never completely fixed. I created an issue for it. https://github.com/OWASP/CheatSheetSeries/issues/1089

The main points are 2 years old, with newer edits: https://github.com/OWASP/CheatSheetSeries/blame/master/cheat... Catch-log-new error-rethrow or catch-annotate-rethrow is (unfortunately) an important part of using Promises that isn't widely taught. I've also seen some Promise replacements with better debugging (often call site carry through, so more like a stack trace) - though I like to keep it vanilla.

Worth mentioning that according to OWASP's latest recommendation #1 is considered as a first line of defense and #2 is considered more as a defense in depth technique (e.g. in addition to #1, not as a replacement): https://github.com/OWASP/CheatSheetSeries/blob/master/cheats...) The SameSite=Strict is also an honorable mention as an up and coming technique once all browsers support it.

Indeed, this is the canonical way of avoiding CSRF (= XSRF) attacks. I intentionally only explained the header method because I didn't want to confuse readers with another concept, and because it's a really nice example to explain CORS. https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... is probably one of the best documents discussing this, including the drawbacks of the header method that I used (and warned against) in my example: https://github.com/OWASP/CheatSheetSeries/blob/master/cheats...

You can mark a cookie as samesite: https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... (as you mentioned, backwards compatibility requires that this is opt-in when the cookie is set, not opt-out)

Another option is to use a secure token (https://github.com/OWASP/CheatSheetSeries/blob/master/cheats...) this is a PITA but frameworks like ASP.NET have this baked in so it's not really much of a hassle in practice.

I gave this code a quick skim and it seems reasonably well thought out and I wish I'd seen it before I rolled my own at work. There are numerous security flaws that one can accidentally introduce with SAML and it seems you've avoided the obvious ones at the very least (i.e. not checking there's only a single assertion, etc). Just in case you weren't aware of it, I found this page very helpful when developing mine: https://github.com/OWASP/CheatSheetSeries/blob/master/cheats...