Cookie SameSite Attribute Security Test and Remediation Tips

Cookie SameSite Attribute is scanned as part of the Sensitive Data Exposure Security Tests used to evaluate the Web Application Security Risk Vector.

SameSite attributes prevent cookies from being passed to cross-origin browsing contexts and are one mitigating technique to prevent cross-site request forgery. Cookie SameSite Attribute findings are informational only. They are always NEUTRAL and they do not impact the rating.

Mitigation Tips

In general, session and other tracking cookies should be explicit about how permissive the use of the cookie can be across origins. The current default behavior on most modern browsers is SameSite=Lax, which may be too permissive for session cookies on some web applications.

What will I see in the Portal?

Finding Message: Cookie set without the SameSite attribute defined

Possible Grades: They are always NEUTRAL and they do not impact the rating. (Weight = N/A)

Issue: Cookie set without the SameSite attribute defined

Details: Cookies without the SameSite attribute may be passed to cross-origin browsing contexts and lead to attacks such as Cross Site Request Forgery (CSRF).

Remediation Tip: Session and other tracking cookies should be explicit about how permissive the use of the cookie can be across origins.