Description

Detects JavaScript code that sets cookies with insecure SameSite attributes. SameSite attribute helps prevent CSRF attacks by controlling how cookies are sent in cross-site requests. Missing or improperly configured SameSite attributes can expose applications to cross-site request forgery attacks.

Detection Strategy

• Check calls to cookie-setting methods like document.cookie or methods that set cookie attributes

• Inspect cookie configuration arguments to identify SameSite attribute settings

• Report vulnerability when cookies are set without SameSite attribute or with insecure values like 'None' without secure flag

• Flag cookie operations that don't explicitly set strict SameSite protections

Vulnerable code example

import express from 'express';
const app = express();

app.get('/login', (req, res) => {
  // Vulnerable: SameSite=None allows CSRF attacks
  res.setHeader('Set-Cookie', 'token=abc123; Path=/; Secure; SameSite=None');
  res.send('Cookie set');
});

✅ Secure code example

import express from 'express';
const app = express();

// Method 1: Using raw header with SameSite=Lax (recommended default)
app.get('/login', (req, res) => {
  // Safe: SameSite=Lax prevents CSRF while allowing common use cases
  res.setHeader('Set-Cookie', 'token=abc123; Path=/; Secure; SameSite=Lax');
  res.send('Cookie set');...