csrf is dead?
CSRF is the classic web vulnerability. Most of bug bounty hunter submit this kind of reports.
but after the browser(Firefox,Chrome,MS edge) update the security feature(samesite) to avoid the track the user by using cookie and avoid the CSRF attack, CSRF is dead, most classic CSRF attack is dead.
samesite feature set up
our cookie will only be sent in a first-party context. In user terms, the cookie will only be sent if the site for the cookie matches the site currently shown in the browser’s URL bar.
1 | Set-Cookie: promo_shown=1; SameSite=Strict |
The Lax label means cookies are only set when the domain in the URL of the browser matches the cookie’s domain—making it a first-party cookie.
1 | Set-Cookie: promo_shown=1; SameSite=Lax |