Summary #

Invicti has detected a cookie setting a SameSite=None attribute without setting a Secure attribute. This is an invalid format and will cause the browser to reject the cookie.

Until this point, the default browser behavior was to append the cookies to the cross-site requests if the SameSite is not implemented. From now on, browsers will fallback to SameSite=Lax behavior by default. Thus, SameSite=None; Secure is added as a new SameSite mode in most modern browsers to disable the default SameSite behavior.

Remediation #

Add the Secure attribute to all of the SameSite=None cookies. Below is a valid cookie example:

Set-Cookie: key=value; SameSite=None; Secure
Classifications #
CWE-16; ISO27001-A.14.2.5; WASC-15
Vulnerability Index

Vulnerability Index

You can search and find all vulnerabilities


Search Vulnerability


Dead accurate, fast & easy-to-use Web Application Security Scanner

Get a demo