Description

This detector identifies PHP setcookie() calls that use insecure SameSite attribute configurations. The SameSite attribute controls when cookies are sent with cross-site requests, and improper configuration can lead to CSRF attacks and cookie-based vulnerabilities.

Detection Strategy

• Identifies calls to the PHP setcookie() function in the source code

• Checks that the setcookie call has exactly 3 arguments (name, value, options)

• Verifies the first argument (cookie name) contains potentially unsafe content

• Analyzes the third argument (options array) to detect insecure SameSite attribute usage

• Reports vulnerability when the options array contains problematic SameSite configurations that could enable cross-site cookie transmission

Vulnerable code example

<?php

function vulnerable_cookie(): void
{
    setcookie("session", "value", [
        'samesite' => 'None', // Vulnerable: allows cross-site requests
    ]);
}...

✅ Secure code example

<?php

function secure_cookie(): void
{
    setcookie("session", "value", [
        'samesite' => 'Strict', // Secure: prevents cross-site requests
    ]);
}...