Establishing a robust long-term security model for cookies on the web
by Artur Janc. Browser vendors' efforts to disable third-party cookies are motivated primarily by privacy / anti-tracking considerations, but they have a significant - and generally underappreciated - impact on the overall security of the web platform. The presence of third-party cookies is the root cause of multiple classes of vulnerabilities in web applications, such as Cross-Site Request Forgery (CSRF), clickjacking and numerous cross-site leaks; consequently, blocking the sending of cookies on cross-site requests would provide web applications with substantial isolation benefits. What cookie model should we aim for from a security perspective?