The cookie has no SameSite attribute.

COOKIE_NO_SAMESITE · Severity: Info

• InfoCOOKIE_NO_SAMESITE

  The cookie has no SameSite attribute.

  Chromium-based browsers then treat it as SameSite=Lax, while others send it on every cross-site request. Setting SameSite explicitly gives the same behaviour everywhere and limits cross-site request forgery.

  Recommendation: Add SameSite=Lax (or Strict) unless the cookie must work cross-site.

Reported by

• Set-Cookie parser

Available through the API

• Set-Cookie parser API

Related findings

• Warning COOKIE_NO_SECURE The cookie has no Secure attribute.
• Info COOKIE_NO_HTTPONLY The cookie can be read by scripts (no HttpOnly attribute).
• Warning COOKIE_NOT_SECURE The HTTPS site sets a cookie without the Secure attribute.
• Error COOKIE_INVALID The Set-Cookie value has no valid name=value pair.
• Info COOKIE_LONG_LIFETIME The cookie asks to live longer than the 400 days browsers allow.
• Info COOKIE_MULTIPLE The text holds more than one cookie; only the first was checked.

All findings