Cookie SameSite attribute restricts how cookies are sent to cross-domain requests. This is an effective measure against Cross Site Request Forgery (CSRF) attacks.

Remediation

Set SameSite=Strict for session cookies.

Metadata

• Severity: informational
• Slug: improper-cookie-samesite-attribute

CWEs

• 1275: Sensitive Cookie with Improper SameSite Attribute
• 352: Cross-Site Request Forgery (CSRF)

OWASP

• A01:2021: Broken Access Control