SameSite=Lax doesn't protect you from login-CSRF | Xiliux Blog
We built an identity server — Bachué — with password login, a second factor, and cookie sessions. The cookies carry SameSite=Lax , and we took for granted what "everyone knows": that SameSite=Lax protects against CSRF. We didn't trust our own review. The author of a piece of code is the worst placed to audit it: what they reasoned already feels verified. So we asked three different models to…
An identity server named Bachué was constructed with password login, two-factor authentication, and cookie sessions. It was assumed that SameSite=Lax cookies would protect against cross-site request forgery (CSRF). Three separate models were used to test the security of the system. The first model incorrectly claimed that SameSite=Lax allowed cross-site POST requests through, despite SameSite=Lax cookies not being sent in POST requests from other sites.
The second model disagreed with the first. The third model found a different type of CSRF vulnerability, known as login-CSRF, which SameSite protection does not cover. This type of CSRF occurs when login and registration endpoints do not require a victim's cookie, allowing an attacker to submit a POST request with their own credentials, effectively logging the user in as the attacker.
SameSite protection does not prevent this type of CSRF. The article emphasizes the importance of putting independent adversaries to the test to ensure the security of code and not solely relying on claims or superficial reviews.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
