Description

Detects when Java Spring applications configure session cookies with 'SameSite=None', which allows the cookie to be sent in cross-site requests. This makes the application potentially vulnerable to CSRF attacks since cookies will be transmitted even in requests originating from other domains.

Detection Strategy

• Check configuration files for cookie settings in Spring applications

• Look for 'same-site' property explicitly set to 'none' (case-insensitive)

• Verify the setting applies to server session cookies

• Report vulnerability if a session cookie has SameSite=None without additional protections

Vulnerable code example

spring:
  server:
    servlet:
      session:
        cookie:
          same-site: None  # Vulnerable: Allows cross-site requests which enables CSRF attacks
          secure: true
      context-path: /api...

✅ Secure code example

spring:
  server:
    servlet:
      session:
        cookie:
          same-site: Strict  # Protects against CSRF by restricting cross-site requests
          secure: true       # Ensures cookies are only sent over HTTPS
      context-path: /api...