Windows 10: Previewing support for same-site cookies in Microsoft Edge

Brink · May 17, 2018

Yesterday’s Windows Insider Preview build (build 17672) introduces support for the SameSite cookies standard in Microsoft Edge, ahead of a planned rollout in Microsoft Edge and Internet Explorer. Same-site cookies enable more protection for users against cross-site request forgery (CSRF) attacks.

Historically, sites such as example.com that make “cross-origin” requests to other domains such as microsoft.com have generally caused the browser to send microsoft.com’s cookies as part of the request. Normally, the user benefits by being able to reuse some state (e.g., login state) across sites no matter from where that request originated. Unfortunately, this can be abused, as in CSRF attacks. Same-site cookies are a valuable addition to the defense in depth against CSRF attacks.

Sites can now set the SameSite attribute on cookies of their choosing via the Set-Cookieheader or by using the document.cookie JavaScript property, thus preventing the default browser behavior of sending cookies in cross-site requests either in all cross-site requests (via the “strict” value) or only in some less sensitive requests (via the “lax” value).

More specifically, if the strict attribute is specified for when a same-site cookie is set, it will not be sent for any cross-site request, which includes clicking on links from external sites. Since the logged-in state is stored as a SameSite=Strict cookie, when a user clicks such a link it will initially appear as if the user is not logged in.

On the other hand, if the lax attribute is specified for when a same-site cookie is set, it will not be sent for cross-origin sub-resource requests such as images. However, the SameSite=Laxcookies will be sent when navigating from an external site, such as when a link is clicked.

This feature is backwards compatible―that is, browsers that don’t support same-site cookies will safely ignore the additional attribute and will simply use the cookie as a regular cookie.

We continuously work to improve our support of standards towards a more interoperable web. Although same-site cookies is not yet a finalized standard at the Internet Engineering Task Force (IETF), we believe the feature is stable and compelling enough to warrant an early implementation as the standardization process progresses.

To broaden the security benefits of this feature, we plan to service Microsoft Edge and Internet Explorer 11 on the Windows 10 Creators Update and newer to support same-site cookies as well, allowing sites to rely on same-site cookies as a defense against CSRF and other related cross-site timing and cross-site information-leakage attacks.

— Ali Alabbas, Program Manager, Microsoft Edge
— Gabriel Montenegro, Program Manager, Windows Networking
— Brent Mills, Program Manager, Internet Explorer
Click to expand...

Source: Previewing support for same-site cookies in Microsoft Edge - Microsoft Edge Dev Blog

:)

Anthony Cato · May 17, 2018

Cookie Management in Microsoft Edge

Hello,

Your browsing history is the information that Microsoft Edge remembers and stores on a PC as your browse the web. This includes info you've entered into forms, passwords, and sites you've visited, and it helps make your browsing experience better.

Kindly follow the below steps to manage cookies in Microsoft Edge.

Open Microsoft Edge.

Click on More options (… symbol) on the top right corner of the browser.

Select Settings from the drop down menu.

Click on Choose what to clear under
Clear browsing data.

Check the Cookies and saved website data
(and any other data you want to clear) and click on
Clear button.

Reference: We suggest you to refer the below Microsoft help article for more information about Microsoft Edge:

Microsoft Edge preview

Kindly let us know if you need any further assistance with Windows.

FrankieRaney · May 17, 2018

Edge tracking cookies

I have had the same problem. All these tracking cookies slow down my machine. Edge has gotten to be the best except for this problem.

I suggest going to Chrome, blocking third party cookies (that's what tracking cookies are) and using SuperAntiApyware (it is the best out there) to scan and remove. Chrome also has a way to add sites to the blocking list if any get through. I do this and
my machine is faster and tracking free!!

When Microsoft gets this capability, I will be back, not before.

Pay attention Microsoft!!

Windows 10: Previewing support for same-site cookies in Microsoft Edge

Previewing support for same-site cookies in Microsoft Edge

Previewing support for same-site cookies in Microsoft Edge

Previewing support for same-site cookies in Microsoft Edge - Similar Threads - Previewing support same

Is this a valid Microsoft Support Site

Is this a valid Microsoft Support Site

Javascript disabled on on sites on Microsoft Edge

Edge (chrome) Cookies and site data

Cookie drop observed on Microsoft Edge

Cookie Management in Edge

Edge Not Giving Suggested Sites When Using 'Dont Block Cookies'

Microsoft Edge Top Sites

Delete Cookies in Microsoft Edge in Windows 10

Users found this page by searching for:

samesite cookie microsoft edge behaviour