Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:100306
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.17.21 as permitted sender)
To: Lars Strojny <lars@strojny.net>,
 "internals@lists.php.net" <internals@lists.php.net>
References: <14052ebf-efea-cb43-39e0-bdc30e493ff3@genkgo.nl>
 <CAPhkiZyn-nVS1ngds2SgYG3oAebtJkQOaJxOccD1eoCrvvcmJQ@mail.gmail.com>
 <08f6d5f1-a7e7-90a3-1b6a-ac353498cef8@genkgo.nl>
 <CAPhkiZzv5zC3VmcNBokhk4qxHdCgnOM7q5jnbHpTvDB=JOvb5g@mail.gmail.com>
 <CAPhkiZyOwun6bQmh0hBz4-d1vjv=FNN49m3Hkn5aBOScNsG0Ug@mail.gmail.com>
 <4a30e3b3-d149-f76c-23fc-79a09a80b044@genkgo.nl>
 <7a1f1617-5864-ad7c-f439-3c9f87cacfd1@genkgo.nl>
 <00CA5219-C7C8-49C8-897E-4CC6C3AA2C81@strojny.net>
Message-ID: <60cf3e36-384a-e90f-fd09-88b0de6b0ba5@gmx.de>
Date: Sat, 26 Aug 2017 00:18:16 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.3.0
MIME-Version: 1.0
In-Reply-To: <00CA5219-C7C8-49C8-897E-4CC6C3AA2C81@strojny.net>
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] [RFC] samesite cookie implementation
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 25.08.2017 at 22:54, Lars Strojny wrote:

> I strongly believe this is something we should ship with 7.2. That
> would give the ecosystem a 1-year head with a feature that could
> eventually help eradicate CSRF. I would argue that this is worth the
> unorthodox circumnavigation of our policies. Do you think that’s
> outrageously crazy?

Considering the current browser support
(https://caniuse.com/#search=samesite), I am not convinced that any rush
is appropriate.  In the worst case, developers might rely on this
feature, while in fact the option is ignored by many browsers, and as
such gives a false sense of security.

-- 
Christoph M. Becker