The SameSite attribute has a value browsers do not know.

COOKIE_SAMESITE_INVALID · Severity: Warning

• WarningCOOKIE_SAMESITE_INVALID

  The SameSite attribute has a value browsers do not know.

  SameSite takes Strict, Lax or None. Any other value is ignored, so the cookie gets the browser's default instead of the intended setting.

  Recommendation: Use SameSite=Strict, SameSite=Lax or SameSite=None with Secure.

Reported by

• Set-Cookie parser

Available through the API

• Set-Cookie parser API

Related findings

• Error COOKIE_SAMESITE_NONE_INSECURE SameSite=None without Secure: browsers reject the cookie.
• Error COOKIE_INVALID The Set-Cookie value has no valid name=value pair.
• Info COOKIE_LONG_LIFETIME The cookie asks to live longer than the 400 days browsers allow.
• Info COOKIE_MULTIPLE The text holds more than one cookie; only the first was checked.
• Warning COOKIE_NOT_SECURE The HTTPS site sets a cookie without the Secure attribute.
• Info COOKIE_NO_HTTPONLY The cookie can be read by scripts (no HttpOnly attribute).

All findings