CSRF in 120 seconds! As you remember Cookies without SameSite | Hack3rScr0lls

CSRF in 120 seconds!

As you remember Cookies without SameSite are treated as SameSite=LAX in Chrome. But there is one exception that can be used as a temporary policy bypass.

If Cookies without SameSite is obtained less than 120 seconds ago, then you can CSRF using the typical POST form.

How to exploit it:
Force the victim to re-login and to get fresh cookies, for example with OAuth.
1. window.open('/api/login/oauth') -> auto relogin
2. POST /api/vuln/method -> CSRF attack

Force the victim to log out and redirect to the login page, then wait until the victim is logged in.
1. GET /api/user/logout -> clear session
2. window.open('/login_form') -> wait
3. POST /api/vuln/method -> CSRF attack

More detailed examples by @RenwaX23

#CSRF #SameSite #Cookies