This weakness occurs when a web application stores sensitive data such as session tokens or authentication credentials in a cookie but fails to set the…
This weakness occurs when a web application stores sensitive data (such as session tokens or authentication credentials) in a cookie but fails to set the SameSite attribute, or sets it to an unsafe value like None. Without proper SameSite protection, the browser will send the cookie along with cross-site requests, enabling attackers to forge requests on behalf of authenticated users or intercept sensitive cookie data.
Cookies are automatically included in HTTP requests to their origin domain, regardless of where the request originated. The SameSite attribute tells the browser whether to send a cookie when a request comes from a different site. When SameSite is omitted or set to None, the cookie is sent with all requests—including those triggered by malicious cross-site pages. An attacker can then craft a request (via a form submission, image tag, or fetch call) that forces an authenticated user's browser to perform an unwanted action, or the attacker can read the cookie if SameSite=None is combined with Secure but no other protections exist.
An attacker can exploit this to perform unauthorized actions on behalf of a logged-in user—such as changing account settings, transferring funds, or deleting data—without the user's knowledge. In cases where SameSite=None is set without Secure, sensitive session tokens may be leaked to third-party sites. The severity depends on what the cookie protects; a session cookie for an admin panel is far more dangerous than a cookie for a non-critical preference.
from flask import Flask, make_response
app = Flask(__name__)
@app.route('/login', methods=['POST'])
def login():
response = make_response("Login successful")
# Missing SameSite attribute — cookie sent with cross-site requests
response.set_cookie('session_token', 'abc123xyz', httponly=True, secure=True)
return responseWhy it's vulnerable:
The cookie is set without a SameSite attribute, so the browser will include it in cross-site requests, enabling CSRF attacks or token leakage.
from flask import Flask, make_response
app = Flask(__name__)
@app.route('/login', methods=['POST'])
def login():
response = make_response("Login successful")
# SameSite=Strict prevents cookie from being sent with cross-site requests
response.set_cookie('session_token', 'abc123xyz', httponly=True, secure=True, samesite='Strict')
return response<?php
// Missing SameSite attribute — cookie sent with cross-site requests
setcookie('session_id', 'user_token_value', [
'httponly' => true,
'secure' => true,
// 'samesite' is not set
]);
?>Why it's vulnerable:
Without SameSite, the cookie is included in all requests to the domain, including those from attacker-controlled sites.
<?php
// SameSite=Strict prevents the cookie from being sent with cross-site requests
setcookie('session_id', 'user_token_value', [
'httponly' => true,
'secure' => true,
'samesite' => 'Strict',
]);
?>SameSite=Strict for all cookies containing authentication tokens or sensitive session data; use SameSite=Lax only if cross-site navigation (e.g., following a link from an external site) must preserve the session.
SameSite=None with Secure (HTTPS-only) if you must allow cross-site cookie transmission; document why this exception exists.
setcookie() / set_cookie() calls in your codebase and verify each one has an explicit SameSite value.
Set-Cookie directives in your web server or framework configuration to enforce SameSite globally where possible.
SameSite is present and set correctly.
SameSite.
Check your application's cookies in the browser's developer tools (F12 → Application → Cookies). If any cookie storing a session token, authentication credential, or user ID lacks a SameSite attribute, or shows SameSite=None without a documented reason, your application is vulnerable. Review server logs for unusual cross-site requests or unexpected state changes (password resets, profile updates) initiated by users who did not directly trigger them.
