How does ASP.NET – "SameSite Cookie" block XSS attacks?

How does ASP.NET – "SameSite Cookie" block XSS attacks?

Please give me a quick view under the covers how this .NET Framework Version 4.7.2 feature helps stop XSS attacks.

And how is it that an MVC site did not have this exposure with earlier versions of .NET Framework?

curiouswebsterSoftware EngineerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

btanExec ConsultantCommented:
SameSite-cookies is a mechanism for defining how cookies should be sent over domains.

I see that it is more of CSRF protection.

If you set the session cookie as same site, it will only be sent if a request emanates from your site. So a standard CSRF attack where the attacker lures the victim to the site that posts a request to will not work. Since is not the same origin as, the browser will not send the session cookie, and transfer.php will execute as if the victim was not logged in.

Strictly speaking not XSS protection. The same-site cookie does nothing to protect you from ordinary XSS attacks. If a hacker manages to fool your site to echo out script from the URL on your site, it will be executed as coming from your origin (after all, it is), and thus session cookies will still be sent with all requests the injected script makes to your domain.

However, it can be good against, let's say XSS inclusion attack which is another form of XSS that takes advantage of the fact that browsers don't prevent webpages from including resources like images and scripts, which are hosted on other domains and servers.

 For example, if Bank ABC's site has a script that reads a user's private account information, a hacker could include that script in their own malicious site ( to pull information from Bank ABC's servers whenever a client of Bank ABC visits the hacker's site.

In the existing cookie protection, it is tagged with HttpOnly and Secure. The SameSite flag was introduced by Google in 2016. Browser need to support that and only firefox and chrome were ahead. IE and Edge came later
We continuously work to improve our support of standards towards a more interoperable web. Although same-site cookies is not yet a finalized standard at the Internet Engineering Task Force (IETF), we believe the feature is stable and compelling enough to warrant an early implementation as the standardization process progresses.

To broaden the security benefits of this feature, we plan to service Microsoft Edge and Internet Explorer 11 on the Windows 10 Fall Creators Update and newer to support same-site cookies as well, allowing sites to rely on same-site cookies as a defense against CSRF and other related cross-site timing and cross-site information-leakage attacks.

So likely the .NET 4.7.2 and 4.8 come in later too. Regardless, for those developing sites in ASP.NET, the Microsoft Anti-Cross Site Scripting Library can help as bare minimal to protect Web applications from cross-site scripting bugs.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
curiouswebsterSoftware EngineerAuthor Commented:
thanks for the detailed answer(s)
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.