Javascript to exploit cookies with samesite attribute?

Question

If a cookie is set with samesite strict, is it possible to be sent with a javascript to another site, like using javascript to get the cookie and send it to another user?

Answer 1

Yes, samesite cookies can be read using javascript. So they are vulnerable to XSS attacks same as any other cookie.

You can test this out yourself, by opening chrome inspector on any website and typing the following:

// Set cookie
document.cookie = 'auth=lol;samesite=strict';
// Read cookie
console.log(document.cookie); // "auth=lol"

You may be thinking of httpOnly? Setting httpOnly will prevent reading in javascript, and will therefore prevent XSS. https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#Security

Answer 2

Yes. You refer to a state where you run a script on a client's browser. A samesite cookie indicates the behavior of a browser's request when it handles a site's cookies, but it is still accessible locally by the scripts.

Like @jameslol said, you may refer to HttpOnly flagged cookies. A server can set the HttpOnly flag for a Set-Cookie response header. If your target's browser supports the HttpOnly flag, then local scripts cannot access the cookie.

However, if the browser doesn't support this flag, it will set a regular cookie instead, yielding the cookie(s) accessible by the client scripts.

Additional reading :

• HttpOnly flag
• List of HttpOnly flag browser support table
• samesite flag and CSRF attacks