SameSite and forged requests

Imagine someone slips a signed form into a pile of papers on your desk, and you hand the whole pile to the bank without reading it. The bank sees your signature and does what the form says. Nobody stole your signature; they just got you to carry their request.

The practice attack, step by step

Everything here is fictional: bank.example and prizes.example are practice sites.

1. You log in to bank.example. It sets Set-Cookie: session=s-55; SameSite=None; Secure.
2. Later you open prizes.example, which says "You have won! Click to claim."
3. Behind the button is a hidden form that sends a POST to bank.example/transfer with "to: prize-account, amount: 500".
4. Your browser sends it, and because the cookie says SameSite=None, it attaches session=s-55. The bank sees a logged-in request and carries it out.

The defence

SameSite lets the bank say when its cookie may travel with a request that started on another site:

• Strict: never. Safest, but if you click a link to the bank from an email, you arrive looking logged out.
• Lax: only for a top-level GET, such as clicking a link. A hidden POST from prizes.example arrives with no cookie, so the bank refuses it.
• None: always. Needed by some embeds, but it leaves the door open to this trick.

Real banks add a second lock as well: a secret CSRF token hidden in their own forms, which a page on another site cannot know. SameSite is the first lock; tokens are the second.

Your first lines of Python

You will write a small function, a named recipe that takes some inputs and gives back an answer. You only need three pieces of Python, all shown here:

def is_big(n):           # "def" starts a function called is_big, with one input n
    if n > 10:           # "if" checks a condition; the indented lines run only when it is true
        return True      # "return" hands back the answer and stops
    return False

print(is_big(12))        # True
print("a" == "a")        # == asks "are these equal?" and gives True or False
print(True and False)    # "and" is True only when both sides are True: here False

A function returns as soon as it hits a return, so checking rules in order, top to bottom, works naturally.

Two more things you will see in the starter. Text in quotes, such as "GET" or "bank.example", is called a string: Python compares strings letter for letter, so "Lax" == "lax" is False. And a block of text between three quote marks right under a def line is a note describing the function; Python does not run it.

// JavaScript (Node.js with Express)
res.cookie("session", "s-55", { secure: true, httpOnly: true, sameSite: "lax" });

# Python (Django settings.py)
SESSION_COOKIE_SAMESITE = "Lax"
SESSION_COOKIE_SECURE = True

// Go (net/http)
http.SetCookie(w, &http.Cookie{Name: "session", Value: "s-55",
    Secure: true, HttpOnly: true, SameSite: http.SameSiteLaxMode})

// PHP 7.3 or later
setcookie("session", "s-55", ["secure" => true, "httponly" => true, "samesite" => "Lax"]);

// C# (ASP.NET Core)
Response.Cookies.Append("session", "s-55", new CookieOptions {
    Secure = true, HttpOnly = true, SameSite = SameSiteMode.Lax });