CWE-1275
Sensitive Cookie with Improper SameSite Attribute
AI Translation Available
The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
Status
incomplete
Abstraction
variant
Likelihood
medium
Affected Platforms
Web Based
Web Server
Extended Description
AI Translation
The SameSite attribute controls how cookies are sent for cross-domain requests. This attribute may have three values: 'Lax', 'Strict', or 'None'. If the 'None' value is used, a website may create a cross-domain POST HTTP request to another website, and the browser automatically adds cookies to this request. This may lead to Cross-Site-Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens).
Technical Details
AI Translation
Common Consequences
confidentiality
integrity
non-repudiation
access control
Impacts
modify application data
Detection Methods
automated static analysis
Potential Mitigations
Phases:
implementation
Descriptions:
•
Set the SameSite attribute of a sensitive cookie to 'Lax' or 'Strict'. This instructs the browser to apply this cookie only to same-domain requests, which provides a good Defense in Depth against CSRF attacks. When the 'Lax' value is in use, cookies are also sent for top-level cross-domain navigation via HTTP GET, HEAD, OPTIONS, and TRACE methods, but not for other HTTP methods that are more like to cause side-effects of state mutation.