> Allow all GET, HEAD, or OPTIONS requests.
> These are safe methods, and are assumed not to change state at various layers of the stack already.
Plenty of apps violate this assumption and do allow GET requests to alter state.
The article seemingly says "these cookies won't be sent with an unsafe request. But that doesn't fix it!" And doesn't elaborate?
One thing is that it won’t work for WebSockets (which start as a GET, which is allowed as-is here) so I had to effectively copy out the implementation from the stdlib for that use case (which is not much - it’s a couple lines, really).
nchmy•1h ago
jerf•1h ago
No shade on the people implementing this stuff, I understand the backwards compatibility concerns, but I mean, keeping up with this stuff is harder than it should be. And thanks to backwards compatibility most of it still defaults open, though browsers have pecked at that as they can.