Description

This detector identifies Go HTTP cookies that are configured with insecure SameSite attribute settings. The SameSite attribute controls whether cookies are sent with cross-site requests, and improper configuration can lead to CSRF attacks and session fixation vulnerabilities.

Detection Strategy

• Scans Go source code that imports the 'net/http' package

• Identifies HTTP cookie objects (http.Cookie type) in the code

• Analyzes each cookie configuration to check if the SameSite attribute is missing or set to an insecure value

• Reports vulnerabilities when cookies lack proper SameSite protection that could allow cross-site request forgery attacks

Vulnerable code example

package main

import "net/http"

func handler(w http.ResponseWriter, r *http.Request) {
	http.SetCookie(w, &http.Cookie{
		Name:     "session",
		Value:    "token123",...

✅ Secure code example

package main

import "net/http"

func handler(w http.ResponseWriter, r *http.Request) {
	http.SetCookie(w, &http.Cookie{
		Name:     "session",
		Value:    "token123",...