Collected research

CSRF Resurrections Starring the Unholy Trinity

DEF CON 30 - Dongsung Kim - CSRF Resurrections Starring the Unholy Trinity

Dongsung Kim · av.tib.eu · 20 October 2022

A DEF CON 30 talk arguing that SameSite cookies did not kill CSRF. Chaining three interacting web features, a PWA service worker, the Fetch API and SameSite's own rules, lets cross-site requests reach a target with cookies attached, and popular libraries make the pattern easy to introduce by accident.

Record

Document

DEF CON 30 - Dongsung Kim - CSRF Resurrections Starring the Unholy Trinity

Researcher

Dongsung Kim

Published by

av.tib.eu

Date

20 October 2022

Format

Recording

Topic

Other

In the archive

• Collected in the 2022 research round

Related sources

• The CSRF Resurrections

Tags

• csrf
• service-worker
• cookie
• sop-bypass
• javascript
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Dongsung Kim, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.