1
Cross-Site Request Forgery is dead
After toiling with Cross-Site Request Forgery on the web for, well forever really, we finally have a proper solution, it's Same-Site Cookies.
Scott Helme
Hi, I'm Scott Helme, a Security Researcher, Entrepreneur and International Speaker. I'm the creator of Report URI and Security Headers, and I deliver world renowned training on Hacking and Encryption.
- Popular posts
- 18
- Total points
- 6,245
- HN comments
- 3,248
- Rank
- #150 personal
Visit scotthelme.co.uk → RSS feedOn Hacker News Aug 2015 – Nov 2026
Security & Privacy 17Networking & Internet 10Web & Frontend 6Life, Learning & Writing 2Society, Policy & Culture 1
2
CSRF is really dead
A little while back I wrote a blog post about how "CSRF is dead". It focused on SameSite cookies, a powerful yet simple feature to protect your website against CSRF attacks. As powerful as it was, and as much as it will kill CSRF, you had to enable it on
3
4
We know 15k websites are infected. how do we tell them?
We've identified 15,579 websites that are currently infected with malicious JavaScript and between them, we conservatively estimate that they receive more than 135 million visits every month. We know they're infected, and we have the evidence to back that up, but there's a problem: how on
5
I'm giving up on HPKP
HTTP Public Key Pinning is a very powerful standard that allows a host to instruct a browser to only accept certain public keys when communicating with it for a given period of time. Whilst HPKP can offer a lot of protection, it can also cause a lot of harm too.
6
How widely used are security-based HTTP response headers?
In this blog I look at how widespread the usage of common security based HTTP response headers are in the Alexa Top 1 Million most visited sites.