Session Cookie without SameSite Flag

Impact: Medium


The absence of the SameSite flag in session cookies leaves them vulnerable to cross-site request forgery (CSRF) attacks, where unauthorized actions are performed on behalf of a user. Without the SameSite flag, session cookies are susceptible to being included in cross-origin requests, potentially leading to CSRF exploits.


To enhance security, always set the SameSite flag for session cookies, specifying the appropriate value based on the application’s requirements. This helps prevent unauthorized access to cookies and protects against CSRF attacks by restricting their inclusion in cross-origin requests.


Last updated on May 13, 2024

Use SmartScanner Free version to test for this issue