VRChat API Change Notification - Header Changes #1043

Closed
opened 2026-04-05 16:46:48 +02:00 by MrUnknownDE · 0 comments
Owner

Originally created by @dtupper on 6/26/2023

Hello!

VRChat's API will be making a change soon. We'll be adding the SameSite=Lax attribute to our auth cookies. This is part of an effort to improve our CSRF protection.

Browsers for the most part already treat all cookies this way, but a handful don't. We don't expect this to affect many VRChat-related applications, but we wanted to let you know anyhow.

Additionally, we're going to start filtering requests based on the Origin and Referer headers. Leave those headers empty to avoid being impacted by this change.

Thank you!


This text was also posted here.

*Originally created by @dtupper on 6/26/2023* Hello! VRChat's API will be making a change soon. We'll be adding the `SameSite=Lax` attribute to our auth cookies. This is part of an effort to improve our CSRF protection. Browsers for the most part already treat all cookies this way, but a handful don't. We don't expect this to affect many VRChat-related applications, but we wanted to let you know anyhow. Additionally, we're going to start filtering requests based on the `Origin` and `Referer` headers. Leave those headers empty to avoid being impacted by this change. Thank you! --- This text was also posted [here](https://github.com/vrchatapi/specification/issues/248).
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github/VRCX#1043