References
Where the claims on this site come from. The browser-policy section is the one that dates fastest — if something here looks stale, it probably is.
Standards and specifications
Browser policy — the 2026 landscape
- Chromium: SameSite Updates
- Chromium: SameSite FAQ (including Lax+POST)
- Privacy Sandbox: Next steps for tracking protections in Chrome
- Mozilla Hacks: Changes to SameSite Cookie Behavior
- Mozilla: Total Cookie Protection
- WebKit: Full Third-Party Cookie Blocking and More
- Chrome: Local Network Access
- web.dev: Schemeful Same-Site
Guidance and cheat sheets
Framework documentation
Research and writeups
- Robust Defenses for Cross-Site Request Forgery (Barth, Jackson, Mitchell)
- PortSwigger: Cross-site request forgery (CSRF)
- PortSwigger: Bypassing SameSite cookie restrictions
- PortSwigger: Cross-site WebSocket hijacking
- Alex Edwards: A Modern Approach to Preventing CSRF in Go
- BREACH: SSL, Gone in 30 Seconds