Do you delegate web security to security specialists or are you responsible yourself for implementing web security features and practices?
The W3C SWAG CG survey asks this and other questions and we would value your input as we create Web Security documentation.
@openwebdocs
Why on Google ?
@openwebdocs
This question has a yes/no answer but is not worded in a way that asks yes or no:
When you set cookies that contain a user's login credentials (such as a session ID), do you set the SameSite attribute to "Lax" or "Strict", to control whether the cookie is included in cross-site requests?
@brunogirin @openwebdocs I read the question as "do you set it at all" not "what value do you set it to".
I would've liked a "not aplicable" option at several points. What if I just don't embed any external js etc. My company does have web/browser based products but: little to no js, no external js in most products, no user info besides login/session id, usually runs disconnected from the open internet within internal networks... maybe I wasn't the target group..
First point, yes, that is the intention. It's intended to be read like:
1 ) you set the attribute to Lax or Strict: answer yes
2 ) you don't set the attribute to Lax or Strict: answer no
Second point: you absolutely are the target group!
In the original version of the survey we had "why" questions after each yes/no question - so in your case it would be "no", and "why" would be "because we don't need to take this measure" (where alternative "why" options would be something like "because we couldn't get it to work" or "because we didn't know about it").
However, including these made the survey pretty long we ended up taking it out and deferring that to interviews, which is the reason we ask if people would be prepared to have an interview.
Would you be up to get interviewed about this?
@openwebdocs @brunogirin ok, interesting. Thanks for the response :)