79283935

Date: 2024-12-16 07:49:25
Score: 0.5
Natty:
Report link

Previous answers explain that no cookies are sent on a cross site request when samesite=Strict. The examples show no cookie goes back from site-b to site-a.

There is however another side effect to be aware of. Consider you receive an e-mail and open it in a webmail app in your browser. The e-mail contains a link to site-b and you click the link to open it. Site-b opens and sets its own (session) cookie with samesite=Strict. This cookie will then not be sent back to site-b with any request. The browser considers this a cross-site request where in reality the cookie stays within its own domain.

If you click the browser refresh (F5) then the server will hand out a new session cookie because it did not receive the current active cookie.

If you however retransmit the url displayed in the address bar then it is no longer a cross-site request and all following requests will send the cookie.

This could explain why a perfectly working website suddenly fails to login if you called it from an e-mailed link. (Remember, cookies are not sent with POST requests).

Reasons:
  • Long answer (-1):
  • No code block (0.5):
  • Low reputation (1):
Posted by: kb1