CSRF: The Sleeping Giant - 🛡️ Defending Against Cross-Site Request Forgery via SameSite Cookies

provides a comprehensive deep dive into Cross-Site Request Forgery (CSRF), a web vulnerability that tricks a user's browser into executing unwanted actions on an authenticated website.

Key Sections of the Presentation:
Anatomy of a CSRF Attack (1:26): Explains how browsers act as "naive assistants" that automatically attach session cookies to requests. The attacker leverages this by embedding malicious requests in links or images.
Infamous Real-World Heists (3:47): Highlights how major platforms like YouTube, ING Direct, McAfee, and TikTok have faced CSRF vulnerabilities in the past, proving it is a high-level threat.
SameSite Cookie Defense (5:34): Discusses the SameSite cookie attribute, which tells the browser whether to send cookies during cross-site requests. The video details the evolution from ignoring this setting to modern browsers enforcing Lax as the default.
Tokens, Headers, and Metadata (8:32): Outlines layered defenses, including Synchronizer Tokens, Double Submit Cookies, and Fetch Metadata headers (e.g., Sec-Fetch-Site), which verify the context of a request.
Client-Side CSRF (10:32): Explains an advanced variant where attackers manipulate front-end JavaScript rather than forging requests directly, effectively bypassing traditional server-side defenses.
Building a Bulletproof Web Vault (11:45): Concludes with a masterclass implementation guide, emphasizing the use of framework-native protections, strict SameSite policies, and the fundamental rule: never use a GET request to change data on the server.
Ultimately, the video stresses that there is no "silver bullet" and encourages a strategy of defense-in-depth to keep applications secure.
A Channel to share useful knowledge / Skill 🤓
一個開心share 實用小知識 / 技巧既channel 😆

Видео CSRF: The Sleeping Giant - 🛡️ Defending Against Cross-Site Request Forgery via SameSite Cookies канала Growth From Newbie