Handler for the endpoint that hands a browser its first token.
The endpoint is unauthenticated and stateless, so an attacker can fetch a
token of their own — which buys them nothing. Forging a request still
requires writing the victim's cookie for this origin, which is what the
same-site cookie boundary denies them.
Handler for the endpoint that hands a browser its first token.
The endpoint is unauthenticated and stateless, so an attacker can fetch a token of their own — which buys them nothing. Forging a request still requires writing the victim's cookie for this origin, which is what the same-site cookie boundary denies them.