CSRF After SameSite: Is It Really Dead?
Since 2020, Chrome defaults every cookie to SameSite=Lax unless explicitly set otherwise. That single change killed most classic Cross-Site Request Forgery. But CSRF is not dead — it has just narrowed. Here are the cases that remain.
Web applications · By Thimmagurudu Bathini · Published · 5 min read · Last reviewed
Subdomain trust
SameSite is same-site, not same-origin. attacker.example.com hosted on the same registrable domain shares cookies with app.example.com. If you allow user-controlled subdomains (preview environments, public profile pages on a subdomain, file hosting), CSRF returns.
GET requests with side effects
SameSite=Lax permits top-level GET navigation. Any state-changing endpoint that accepts GET — log out, accept invite, confirm action — is still CSRF-able from a link or window.open. These are common in older codebases. Fix: never mutate state on GET.
The two-minute Lax window
Chrome historically applied a brief grace period where newly-set cookies behaved like SameSite=None for two minutes, to support legacy SSO flows. This window has been tightened but POST-redirect flows still need testing.
JSON-body CSRF and CORS interaction
If an endpoint accepts application/json but does not require a custom header (like X-Requested-With), a cross-origin form with enctype=text/plain can sometimes deliver a malformed-but-accepted JSON body. Belt-and-braces defense: CSRF tokens on state-changing endpoints regardless of content-type.
What we test
For every state-changing endpoint: verify SameSite on the session cookie, require a token or origin check, test the GET-with-side-effects pattern, and test from a same-site sibling subdomain if those exist. The web application penetration testing page describes how such a test runs.
Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana