On: Hacker News CSRF Vulnerability

[mbakke]

Would this still work with 3rd party cookies disabled?

In the years I've used uMatrix[0] I can't remember a single case where sending a cookie with a 3rd party request was needed. Why do browsers do this still?

0: https://github.com/gorhill/uMatrix