CWE-1275

Sensitive Cookie with Improper SameSite Attribute
AI Translation Available

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

Status
incomplete
Abstraction
variant
Likelihood
medium
Web Based Web Server

The SameSite attribute controls how cookies are sent for cross-domain requests. This attribute may have three values: 'Lax', 'Strict', or 'None'. If the 'None' value is used, a website may create a cross-domain POST HTTP request to another website, and the browser automatically adds cookies to this request. This may lead to Cross-Site-Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens).

Common Consequences

confidentiality integrity non-repudiation access control
Impacts
modify application data

Detection Methods

automated static analysis

Potential Mitigations

Phases:
implementation
Descriptions:
• Set the SameSite attribute of a sensitive cookie to 'Lax' or 'Strict'. This instructs the browser to apply this cookie only to same-domain requests, which provides a good Defense in Depth against CSRF attacks. When the 'Lax' value is in use, cookies are also sent for top-level cross-domain navigation via HTTP GET, HEAD, OPTIONS, and TRACE methods, but not for other HTTP methods that are more like to cause side-effects of state mutation.