Unit 4: Cookies and sessions · Lesson 4 of 6 · 20 min
SameSite and cross-site requests
Why a form on another site could act in your name, and the two defences that stop it.
mission
- You are
- The analyst reviewing the shop's account settings.
- Situation
- The account page lets users change their email with a simple form post. If another site could submit that form with the user's cookie, it could take over the account.
- Goal
- Check how the email change endpoint treats requests from other origins.
- Hand in
- Which defences the endpoint has, and what each one stops.
SameSite as a door check
Sign in
curl -s -o /dev/null -c jar.txt -d @shop-account.txt http://127.0.0.1:8000/login && echo signed in
signed in
Change the email from the shop
Browsers add an Origin header to every cross-site and most same-site POSTs. Send the one the shop itself would send.
curl -s -b jar.txt -H 'Origin: http://127.0.0.1:8000' -d 'email=me@example.com' http://127.0.0.1:8000/account/email
{"email": "me@example.com", "changed": true}
you should see The change is accepted.
Pretend to be another site
curl -s -w ' %{http_code}\n' -b jar.txt -H 'Origin: https://coupons.example.net' -d 'email=x@example.net' http://127.0.0.1:8000/account/email
{"error": "cross-site request refused"}
403
you should see 403. The server checks Origin against its own list.
Check the second layer
curl -si -d @shop-account.txt http://127.0.0.1:8000/login | grep -i 'set-cookie: shop_session'
Set-Cookie: shop_session=7f3a9c2e41d8b6a5; Path=/; HttpOnly; SameSite=Lax
you should see SameSite=Lax: a real browser would not even attach the cookie to a cross-site POST.
defender tip Origin checks and SameSite cookies complement each other. Keep both, and add a CSRF token for older browsers and same-site subdomains you do not fully control.
Defences against cross-site forms
Set-Cookie: shop_session=...; SameSite=Lax
The browser leaves the cookie off cross-site POSTs.
if origin and origin not in ALLOWED:
return 403The server refuses what slips through.
What a defender takes away
- 1Cookies travel automatically, so other sites can try to use them.
- 2SameSite stops the browser from sending them; an Origin check stops the server from obeying.
- 3Test state-changing endpoints with a foreign Origin header.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.