logo

Database

Http Cookie Samesite Not Initialized

Description

Detects sensitive cookies (like authentication or session cookies) that have their SameSite attribute explicitly set to "None". This configuration makes these cookies vulnerable to cross-site request forgery (CSRF) attacks since they can be sent in cross-origin requests.

Weakness:

129 - Insecurely generated cookies - SameSite

Category: Access Subversion

Detection Strategy

    Examines Set-Cookie headers in HTTP responses

    Checks if the cookie name indicates sensitive content (e.g., auth, session, token)

    Verifies if the SameSite attribute is explicitly set to 'None'

    Reports a vulnerability when a sensitive cookie is found with SameSite=None