web: Deprecate xsrf_cookies

[bdarnell]

This feature is more invasive than using the samesite cookie attribute
but does not provide additional protection, so it is no longer
something that we should recommend.

[bdarnell]

After consulting with some experts in this area, I've changed my mind about this. SameSite cookies are weaker than the current double-submit cookie implementation, primarily because a "site" as used in SameSite cookies is a broader scope than an "origin" used in the same-origin policy that is used elsewhere in the web security model. (example.com is a site, while foo.example.com and bar.example.com are two different origins within that site). If foo.example.com used only SameSite cookies for XSRF protection, it would be vulnerable to XSRF attacks from bar.example.com, if for example that host included a web application with XSS or other vulnerabilities. And even if there are no other hosts on the same site, a network-level attacker (e.g. an untrusted wifi network) could create one by manipulating DNS.

SameSite cookies might offer enough protection when combined with other techniques such as HSTS, but the combined solution is no longer simple enough that I feel comfortable recommending it as a primary defense against XSRF attacks.

So we'll be keeping xsrf_cookies around, and will in fact be improving it.