标题：*
140 字

TAG标签：（用空格隔开）
30 字

恢复历史版本：

HTML转MD HTML转MD2

<p><a href="https://www.ruanyifeng.com/blog/2019/09/cookie-samesite.html" _src="https://www.ruanyifeng.com/blog/2019/09/cookie-samesite.html">https://www.ruanyifeng.com/blog/2019/09/cookie-samesite.html</a></p><p><br/></p><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">Chrome 51 开始，浏览器的 Cookie 新增加了一个<code style="margin: auto 3px; padding: 0px 5px; list-style-type: none; border: none; display: inline-block; font-size: 15.6px; background-color: pink; border-radius: 5px;">SameSite</code>属性，用来防止 CSRF 攻击和用户追踪。</p><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;"><img src="https://www.wangbase.com/blogimg/asset/201909/bg2019090918.jpg" alt="" title="" style="margin: 0px; padding: 0px; list-style-type: none; border: 0.3em solid rgb(224, 223, 204); border-radius: 1em;"/></p><h2 style="margin: 1.5em 0px 0.2em; padding: 0px 0px 0.2em; list-style-type: none; font-weight: 500; border-top: none; border-right: none; border-bottom: 1px solid rgb(211, 211, 211); border-left: none; border-image: initial; font-size: 2.88em; line-height: 1.35em; letter-spacing: -0.03em; font-family: Georgia, serif; white-space: normal; word-spacing: 2px;">一、CSRF 攻击是什么？</h2><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">Cookie 往往用来存储用户的身份信息，恶意网站可以设法伪造带有正确 Cookie 的 HTTP 请求，这就是 CSRF 攻击。</p><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">举例来说，用户登陆了银行网站<code style="margin: auto 3px; padding: 0px 5px; list-style-type: none; border: none; display: inline-block; font-size: 15.6px; background-color: pink; border-radius: 5px;">your-bank.com</code>，银行服务器发来了一个 Cookie。</p><blockquote style="margin: 2em; padding: 1em; list-style-type: none; border: 0.3em solid rgb(224, 223, 204); color: rgb(17, 17, 17); background-color: rgb(245, 242, 240); border-radius: 1em; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, monospace; text-shadow: white 0px 1px; overflow: auto; font-size: 10px; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;"><pre class=" language-bash" style="margin-top: 0px; margin-bottom: 0px; padding: 0em 0em 0.5em; list-style-type: none; border: none; color: black; text-shadow: white 0px 1px; font-family: monospace, Consolas, Monaco, &quot;Andale Mono&quot;; direction: ltr; word-spacing: normal; font-size: 1.2em; tab-size: 4; hyphens: none; overflow: auto; background-color: rgb(245, 242, 240);">Set-Cookie:id=a3fWa;</pre></blockquote><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">用户后来又访问了恶意网站<code style="margin: auto 3px; padding: 0px 5px; list-style-type: none; border: none; display: inline-block; font-size: 15.6px; background-color: pink; border-radius: 5px;">malicious.com</code>，上面有一个表单。</p><blockquote style="margin: 2em; padding: 1em; list-style-type: none; border: 0.3em solid rgb(224, 223, 204); color: rgb(17, 17, 17); background-color: rgb(245, 242, 240); border-radius: 1em; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, monospace; text-shadow: white 0px 1px; overflow: auto; font-size: 10px; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;"><pre class=" language-markup" style="margin-top: 0px; margin-bottom: 0px; padding: 0em 0em 0.5em; list-style-type: none; border: none; color: black; text-shadow: white 0px 1px; font-family: monospace, Consolas, Monaco, &quot;Andale Mono&quot;; direction: ltr; word-spacing: normal; font-size: 1.2em; tab-size: 4; hyphens: none; overflow: auto; background-color: rgb(245, 242, 240);">&lt;form&nbsp;action=&quot;your-bank.com/transfer&quot;&nbsp;method=&quot;POST&quot;&gt;
&nbsp;&nbsp;...&lt;/form&gt;</pre></blockquote><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">用户一旦被诱骗发送这个表单，银行网站就会收到带有正确 Cookie 的请求。为了防止这种攻击，表单一般都带有一个随机 token，告诉服务器这是真实请求。</p><blockquote style="margin: 2em; padding: 1em; list-style-type: none; border: 0.3em solid rgb(224, 223, 204); color: rgb(17, 17, 17); background-color: rgb(245, 242, 240); border-radius: 1em; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, monospace; text-shadow: white 0px 1px; overflow: auto; font-size: 10px; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;"><pre class=" language-markup" style="margin-top: 0px; margin-bottom: 0px; padding: 0em 0em 0.5em; list-style-type: none; border: none; color: black; text-shadow: white 0px 1px; font-family: monospace, Consolas, Monaco, &quot;Andale Mono&quot;; direction: ltr; word-spacing: normal; font-size: 1.2em; tab-size: 4; hyphens: none; overflow: auto; background-color: rgb(245, 242, 240);">&lt;form&nbsp;action=&quot;your-bank.com/transfer&quot;&nbsp;method=&quot;POST&quot;&gt;
&nbsp;&nbsp;&lt;input&nbsp;type=&quot;hidden&quot;&nbsp;name=&quot;token&quot;&nbsp;value=&quot;dad3weg34&quot;&gt;
&nbsp;&nbsp;...&lt;/form&gt;</pre></blockquote><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">这种第三方网站引导发出的 Cookie，就称为第三方 Cookie。它除了用于 CSRF 攻击，还可以用于用户追踪。</p><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">比如，Facebook 在第三方网站插入一张看不见的图片。</p><blockquote style="margin: 2em; padding: 1em; list-style-type: none; border: 0.3em solid rgb(224, 223, 204); color: rgb(17, 17, 17); background-color: rgb(245, 242, 240); border-radius: 1em; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, monospace; text-shadow: white 0px 1px; overflow: auto; font-size: 10px; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;"><pre class=" language-markup" style="margin-top: 0px; margin-bottom: 0px; padding: 0em 0em 0.5em; list-style-type: none; border: none; color: black; text-shadow: white 0px 1px; font-family: monospace, Consolas, Monaco, &quot;Andale Mono&quot;; direction: ltr; word-spacing: normal; font-size: 1.2em; tab-size: 4; hyphens: none; overflow: auto; background-color: rgb(245, 242, 240);">&lt;img&nbsp;src=&quot;facebook.com&quot;&nbsp;style=&quot;visibility:hidden;&quot;&gt;</pre></blockquote><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">浏览器加载上面代码时，就会向 Facebook 发出带有 Cookie 的请求，从而 Facebook 就会知道你是谁，访问了什么网站。</p><h2 style="margin: 1.5em 0px 0.2em; padding: 0px 0px 0.2em; list-style-type: none; font-weight: 500; border-top: none; border-right: none; border-bottom: 1px solid rgb(211, 211, 211); border-left: none; border-image: initial; font-size: 2.88em; line-height: 1.35em; letter-spacing: -0.03em; font-family: Georgia, serif; white-space: normal; word-spacing: 2px;">二、SameSite 属性</h2><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">Cookie 的<code style="margin: auto 3px; padding: 0px 5px; list-style-type: none; border: none; display: inline-block; font-size: 15.6px; background-color: pink; border-radius: 5px;">SameSite</code>属性用来限制第三方 Cookie，从而减少安全风险。</p><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">它可以设置三个值。</p><blockquote style="margin: 2em; padding: 1em; list-style-type: none; border: 0.3em solid rgb(224, 223, 204); color: rgb(17, 17, 17); background-color: rgb(245, 242, 240); border-radius: 1em; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, monospace; text-shadow: white 0px 1px; overflow: auto; font-size: 10px; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;"><ul style="list-style-type: none;" class=" list-paddingleft-2"><li><p>Strict</p></li><li><p>Lax</p></li><li><p>None</p></li></ul></blockquote><h3 style="margin: 1.5em 0px 0.2em; padding: 0px 0px 0.2em; list-style-type: none; font-weight: 500; border-top: none; border-right: none; border-bottom: 1px solid rgb(211, 211, 211); border-left: none; border-image: initial; font-size: 1.87em; letter-spacing: -0.03em; font-family: Georgia, serif; white-space: normal; word-spacing: 2px;">2.1 Strict</h3><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;"><code style="margin: auto 3px; padding: 0px 5px; list-style-type: none; border: none; display: inline-block; font-size: 15.6px; background-color: pink; border-radius: 5px;">Strict</code>最为严格，完全禁止第三方 Cookie，跨站点时，任何情况下都不会发送 Cookie。换言之，只有当前网页的 URL 与请求目标一致，才会带上 Cookie。</p><blockquote style="margin: 2em; padding: 1em; list-style-type: none; border: 0.3em solid rgb(224, 223, 204); color: rgb(17, 17, 17); background-color: rgb(245, 242, 240); border-radius: 1em; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, monospace; text-shadow: white 0px 1px; overflow: auto; font-size: 10px; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;"><pre class=" language-bash" style="margin-top: 0px; margin-bottom: 0px; padding: 0em 0em 0.5em; list-style-type: none; border: none; color: black; text-shadow: white 0px 1px; font-family: monospace, Consolas, Monaco, &quot;Andale Mono&quot;; direction: ltr; word-spacing: normal; font-size: 1.2em; tab-size: 4; hyphens: none; overflow: auto; background-color: rgb(245, 242, 240);">Set-Cookie:&nbsp;CookieName=CookieValue;&nbsp;SameSite=Strict;</pre></blockquote><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">这个规则过于严格，可能造成非常不好的用户体验。比如，当前网页有一个 GitHub 链接，用户点击跳转就不会带有 GitHub 的 Cookie，跳转过去总是未登陆状态。</p><h3 style="margin: 1.5em 0px 0.2em; padding: 0px 0px 0.2em; list-style-type: none; font-weight: 500; border-top: none; border-right: none; border-bottom: 1px solid rgb(211, 211, 211); border-left: none; border-image: initial; font-size: 1.87em; letter-spacing: -0.03em; font-family: Georgia, serif; white-space: normal; word-spacing: 2px;">2.2 Lax</h3><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;"><code style="margin: auto 3px; padding: 0px 5px; list-style-type: none; border: none; display: inline-block; font-size: 15.6px; background-color: pink; border-radius: 5px;">Lax</code>规则稍稍放宽，大多数情况也是不发送第三方 Cookie，但是导航到目标网址的 Get 请求除外。</p><blockquote style="margin: 2em; padding: 1em; list-style-type: none; border: 0.3em solid rgb(224, 223, 204); color: rgb(17, 17, 17); background-color: rgb(245, 242, 240); border-radius: 1em; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, monospace; text-shadow: white 0px 1px; overflow: auto; font-size: 10px; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;"><pre class=" language-markup" style="margin-top: 0px; margin-bottom: 0px; padding: 0em 0em 0.5em; list-style-type: none; border: none; color: black; text-shadow: white 0px 1px; font-family: monospace, Consolas, Monaco, &quot;Andale Mono&quot;; direction: ltr; word-spacing: normal; font-size: 1.2em; tab-size: 4; hyphens: none; overflow: auto; background-color: rgb(245, 242, 240);">Set-Cookie:&nbsp;CookieName=CookieValue;&nbsp;SameSite=Lax;</pre></blockquote><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">导航到目标网址的 GET 请求，只包括三种情况：链接，预加载请求，GET 表单。详见下表。</p><table width="846"><thead style="margin: 0px; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17);"><tr style="margin: 0px; padding: 0px; list-style-type: none; border: none;" class="firstRow"><th style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: left; font-weight: normal; border-color: rgb(102, 102, 102); font-size: 1.4em; background-color: rgb(222, 222, 222);">请求类型</th><th style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: center; font-weight: normal; border-color: rgb(102, 102, 102); font-size: 1.4em; background-color: rgb(222, 222, 222);">示例</th><th style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: right; font-weight: normal; border-color: rgb(102, 102, 102); font-size: 1.4em; background-color: rgb(222, 222, 222);">正常情况</th><th style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: left; font-weight: normal; border-color: rgb(102, 102, 102); font-size: 1.4em; background-color: rgb(222, 222, 222);">Lax</th></tr></thead><tbody style="margin: 0px; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17);"><tr style="margin: 0px; padding: 0px; list-style-type: none; border: none;"><td style="margin: 0px; padding: 0.6em; list-style-type: none; border-color: rgb(102, 102, 102); font-size: 1.4em;">链接</td><td style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: center; border-color: rgb(102, 102, 102); font-size: 1.4em;"><code style="margin: 0px; padding: 0px; list-style-type: none; text-align: left; border: none;">&lt;a href=&quot;...&quot;&gt;&lt;/a&gt;</code></td><td style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: right; border-color: rgb(102, 102, 102); font-size: 1.4em;">发送 Cookie</td><td style="margin: 0px; padding: 0.6em; list-style-type: none; border-color: rgb(102, 102, 102); font-size: 1.4em;">发送 Cookie</td></tr><tr style="margin: 0px; padding: 0px; list-style-type: none; border: none;"><td style="margin: 0px; padding: 0.6em; list-style-type: none; border-color: rgb(102, 102, 102); font-size: 1.4em;">预加载</td><td style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: center; border-color: rgb(102, 102, 102); font-size: 1.4em;"><code style="margin: 0px; padding: 0px; list-style-type: none; text-align: left; border: none;">&lt;link rel=&quot;prerender&quot; href=&quot;...&quot;/&gt;</code></td><td style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: right; border-color: rgb(102, 102, 102); font-size: 1.4em;">发送 Cookie</td><td style="margin: 0px; padding: 0.6em; list-style-type: none; border-color: rgb(102, 102, 102); font-size: 1.4em;">发送 Cookie</td></tr><tr style="margin: 0px; padding: 0px; list-style-type: none; border: none;"><td style="margin: 0px; padding: 0.6em; list-style-type: none; border-color: rgb(102, 102, 102); font-size: 1.4em;">GET 表单</td><td style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: center; border-color: rgb(102, 102, 102); font-size: 1.4em;"><code style="margin: 0px; padding: 0px; list-style-type: none; text-align: left; border: none;">&lt;form method=&quot;GET&quot; action=&quot;...&quot;&gt;</code></td><td style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: right; border-color: rgb(102, 102, 102); font-size: 1.4em;">发送 Cookie</td><td style="margin: 0px; padding: 0.6em; list-style-type: none; border-color: rgb(102, 102, 102); font-size: 1.4em;">发送 Cookie</td></tr><tr style="margin: 0px; padding: 0px; list-style-type: none; border: none;"><td style="margin: 0px; padding: 0.6em; list-style-type: none; border-color: rgb(102, 102, 102); font-size: 1.4em;">POST 表单</td><td style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: center; border-color: rgb(102, 102, 102); font-size: 1.4em;"><code style="margin: 0px; padding: 0px; list-style-type: none; text-align: left; border: none;">&lt;form method=&quot;POST&quot; action=&quot;...&quot;&gt;</code></td><td style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: right; border-color: rgb(102, 102, 102); font-size: 1.4em;">发送 Cookie</td><td style="margin: 0px; padding: 0.6em; list-style-type: none; border-color: rgb(102, 102, 102); font-size: 1.4em;">不发送</td></tr><tr style="margin: 0px; padding: 0px; list-style-type: none; border: none;"><td style="margin: 0px; padding: 0.6em; list-style-type: none; border-color: rgb(102, 102, 102); font-size: 1.4em;">iframe</td><td style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: center; border-color: rgb(102, 102, 102); font-size: 1.4em;"><code style="margin: 0px; padding: 0px; list-style-type: none; text-align: left; border: none;">&lt;iframe src=&quot;...&quot;&gt;&lt;/iframe&gt;</code></td><td style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: right; border-color: rgb(102, 102, 102); font-size: 1.4em;">发送 Cookie</td><td style="margin: 0px; padding: 0.6em; list-style-type: none; border-color: rgb(102, 102, 102); font-size: 1.4em;">不发送</td></tr><tr style="margin: 0px; padding: 0px; list-style-type: none; border: none;"><td style="margin: 0px; padding: 0.6em; list-style-type: none; border-color: rgb(102, 102, 102); font-size: 1.4em;">AJAX</td><td style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: center; border-color: rgb(102, 102, 102); font-size: 1.4em;"><code style="margin: 0px; padding: 0px; list-style-type: none; text-align: left; border: none;">$.get(&quot;...&quot;)</code></td><td style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: right; border-color: rgb(102, 102, 102); font-size: 1.4em;">发送 Cookie</td><td style="margin: 0px; padding: 0.6em; list-style-type: none; border-color: rgb(102, 102, 102); font-size: 1.4em;">不发送</td></tr><tr style="margin: 0px; padding: 0px; list-style-type: none; border: none;"><td style="margin: 0px; padding: 0.6em; list-style-type: none; border-color: rgb(102, 102, 102); font-size: 1.4em;">Image</td><td style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: center; border-color: rgb(102, 102, 102); font-size: 1.4em;"><code style="margin: 0px; padding: 0px; list-style-type: none; text-align: left; border: none;">&lt;img src=&quot;...&quot;&gt;</code></td><td style="margin: 0px; padding: 0.6em; list-style-type: none; text-align: right; border-color: rgb(102, 102, 102); font-size: 1.4em;">发送 Cookie</td><td style="margin: 0px; padding: 0.6em; list-style-type: none; border-color: rgb(102, 102, 102); font-size: 1.4em;">不发送</td></tr></tbody></table><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">设置了<code style="margin: auto 3px; padding: 0px 5px; list-style-type: none; border: none; display: inline-block; font-size: 15.6px; background-color: pink; border-radius: 5px;">Strict</code>或<code style="margin: auto 3px; padding: 0px 5px; list-style-type: none; border: none; display: inline-block; font-size: 15.6px; background-color: pink; border-radius: 5px;">Lax</code>以后，基本就杜绝了 CSRF 攻击。当然，前提是用户浏览器支持 SameSite 属性。</p><h3 style="margin: 1.5em 0px 0.2em; padding: 0px 0px 0.2em; list-style-type: none; font-weight: 500; border-top: none; border-right: none; border-bottom: 1px solid rgb(211, 211, 211); border-left: none; border-image: initial; font-size: 1.87em; letter-spacing: -0.03em; font-family: Georgia, serif; white-space: normal; word-spacing: 2px;">2.3 None</h3><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">Chrome 计划将<code style="margin: auto 3px; padding: 0px 5px; list-style-type: none; border: none; display: inline-block; font-size: 15.6px; background-color: pink; border-radius: 5px;">Lax</code>变为默认设置。这时，网站可以选择显式关闭<code style="margin: auto 3px; padding: 0px 5px; list-style-type: none; border: none; display: inline-block; font-size: 15.6px; background-color: pink; border-radius: 5px;">SameSite</code>属性，将其设为<code style="margin: auto 3px; padding: 0px 5px; list-style-type: none; border: none; display: inline-block; font-size: 15.6px; background-color: pink; border-radius: 5px;">None</code>。不过，前提是必须同时设置<code style="margin: auto 3px; padding: 0px 5px; list-style-type: none; border: none; display: inline-block; font-size: 15.6px; background-color: pink; border-radius: 5px;">Secure</code>属性（Cookie 只能通过 HTTPS 协议发送），否则无效。</p><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">下面的设置无效。</p><blockquote style="margin: 2em; padding: 1em; list-style-type: none; border: 0.3em solid rgb(224, 223, 204); color: rgb(17, 17, 17); background-color: rgb(245, 242, 240); border-radius: 1em; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, monospace; text-shadow: white 0px 1px; overflow: auto; font-size: 10px; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;"><pre class=" language-bash" style="margin-top: 0px; margin-bottom: 0px; padding: 0em 0em 0.5em; list-style-type: none; border: none; color: black; text-shadow: white 0px 1px; font-family: monospace, Consolas, Monaco, &quot;Andale Mono&quot;; direction: ltr; word-spacing: normal; font-size: 1.2em; tab-size: 4; hyphens: none; overflow: auto; background-color: rgb(245, 242, 240);">Set-Cookie:&nbsp;widget_session=abc123;&nbsp;SameSite=None</pre></blockquote><p style="margin-top: 1em; margin-bottom: 0px; margin-left: 0.8em; padding: 0px; list-style-type: none; border: none; color: rgb(17, 17, 17); font-size: 1.6em; line-height: 28.8px; font-family: Georgia, serif; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;">下面的设置有效。</p><blockquote style="margin: 2em; padding: 1em; list-style-type: none; border: 0.3em solid rgb(224, 223, 204); color: rgb(17, 17, 17); background-color: rgb(245, 242, 240); border-radius: 1em; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, monospace; text-shadow: white 0px 1px; overflow: auto; font-size: 10px; letter-spacing: -0.1px; white-space: normal; word-spacing: 2px;"><pre class=" language-bash" style="margin-top: 0px; margin-bottom: 0px; padding: 0em 0em 0.5em; list-style-type: none; border: none; color: black; text-shadow: white 0px 1px; font-family: monospace, Consolas, Monaco, &quot;Andale Mono&quot;; direction: ltr; word-spacing: normal; font-size: 1.2em; tab-size: 4; hyphens: none; overflow: auto; background-color: rgb(245, 242, 240);">Set-Cookie:&nbsp;widget_session=abc123;&nbsp;SameSite=None;&nbsp;Secure</pre></blockquote><h2 style="margin: 1.5em 0px 0.2em; padding: 0px 0px 0.2em; list-style-type: none; font-weight: 500; border-top: none; border-right: none; border-bottom: 1px solid rgb(211, 211, 211); border-left: none; border-image: initial; font-size: 2.88em; line-height: 1.35em; letter-spacing: -0.03em; font-family: Georgia, serif; white-space: normal; word-spacing: 2px;">三、参考链接</h2><ul style="list-style-type: none;" class=" list-paddingleft-2"><li><p><a href="https://www.netsparker.com/blog/web-security/same-site-cookie-attribute-prevent-cross-site-request-forgery/" target="_blank" style="margin: 0px; padding: 0px; list-style-type: none; border: none; color: rgb(34, 52, 114);">Using the Same-Site Cookie Attribute to Prevent CSRF Attacks</a></p></li><li><p><a href="https://web.dev/samesite-cookies-explained" target="_blank" style="margin: 0px; padding: 0px; list-style-type: none; border: none; color: rgb(34, 52, 114);">SameSite cookies explained</a></p></li><li><p><a href="https://scotthelme.co.uk/tough-cookies/" target="_blank" style="margin: 0px; padding: 0px; list-style-type: none; border: none; color: rgb(34, 52, 114);">Tough Cookies</a>, Scott Helme</p></li><li><p><a href="https://scotthelme.co.uk/csrf-is-dead/" target="_blank" style="margin: 0px; padding: 0px; list-style-type: none; border: none; color: rgb(34, 52, 114);">Cross-Site Request Forgery is dead!</a>, Scott Helme</p></li></ul><p><br/></p>