Viewing profile — steffenweber

Google should reward fast / jank-free websites instead of rewarding websites that use one particular technology (AMP). On SERPs, both the "flash" icon and the AMP carousel are AMP-…

The conclusion of this discussion seems to be that "SameSite" cookies should be used to help preventing CSRF. https://www.igvita.com/2016/08/26/stop-cross-site-timing-att...

CSRF protection is not about attacks from evil clients (you can easily spoof any header with the HTTP client library of your choice, of course). CSRF protection is about preventing…

If all browsers sent the "Origin" HTTP header [1] with POST requests (such that web applications could rely on it) then CSRF [2] tokens mentioned in the article would become obsole…